CVE-2026-76614: OpenEMR Path Traversal Vulnerability

CVE-2026-76614 Overview

CVE-2026-76614 is a path traversal vulnerability in OpenEMR versions before 8.3.0. The flaw resides in the Electronic Data Interchange (EDI) archive restore function, where the archrestore_sel POST parameter is passed to the archive restore handler without sanitization. The handler probes the supplied path on the filesystem and returns different response messages depending on whether the target exists. This behavioral difference allows an authenticated user with EOB Data Entry permissions to enumerate arbitrary filesystem paths on the server.

Critical Impact
Authenticated attackers can determine the existence of arbitrary files and directories on the OpenEMR host, enabling reconnaissance of sensitive filesystem structures [CWE-22].

Affected Products

OpenEMR versions prior to 8.3.0
The vulnerable EDI archive restore handler
Deployments granting EOB Data Entry permissions to lower-privileged users

Discovery Timeline

2026-08-19 - CVE-2026-76614 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-76614

Vulnerability Analysis

The vulnerability exists in the OpenEMR EDI archive restore workflow. When a user submits a restore request, the archrestore_sel POST parameter is consumed directly by the archive restore handler. The handler performs a filesystem existence check on the supplied path but does not validate or sanitize traversal sequences such as ../.

Because the handler returns different messages for existing versus non-existing paths, the response acts as an oracle. An attacker with EOB Data Entry permissions can iterate through candidate paths and infer filesystem layout. The condition falls under path traversal [CWE-22], and the impact is limited to confidentiality of filesystem metadata rather than file content disclosure or code execution.

Root Cause

The root cause is missing input sanitization on the archrestore_sel parameter combined with a verbose response pattern. The handler trusts user-supplied path input and reveals filesystem state through differentiated error messages. This design allows path probing without additional privileges.

Attack Vector

An authenticated user submits crafted POST requests to the EDI archive restore endpoint with traversal sequences in archrestore_sel. By comparing responses across many probe values, the attacker builds a map of files and directories on the OpenEMR server. Exploitation requires valid credentials and EOB Data Entry permissions but no user interaction.

php

// Patch context from OpenEMR commit 7973cab3fe3f2fd2374ed71c02605e3c93491c36
// chore: ACL improvements and misc to several staff endpoints (#13200)
$ignoreErrors[] = [
    'message' => '#^Parameter \\#1 \\$text of function attr expects string, mixed given\\.$#',
-    'count' => 2,
+    'count' => 1,
    'path' => __DIR__ . '/../../library/dicom_frame.php',
];
// Source: https://github.com/openemr/openemr/commit/7973cab3fe3f2fd2374ed71c02605e3c93491c36

Detection Methods for CVE-2026-76614

Indicators of Compromise

POST requests to the OpenEMR EDI archive restore endpoint containing ../ sequences or absolute paths in the archrestore_sel parameter.
Repeated restore requests from the same authenticated session with varying path values, indicative of enumeration.
Anomalous access patterns from accounts holding EOB Data Entry permissions.

Detection Strategies

Inspect web server and application logs for archrestore_sel values containing traversal patterns or paths outside the expected archive directory.
Alert on high-volume restore attempts from a single user within short time windows.
Correlate authenticated OpenEMR sessions with unusual filesystem probing behavior against the application host.

Monitoring Recommendations

Enable verbose logging on the EDI archive restore handler and forward logs to a centralized analytics platform.
Baseline normal restore activity and flag deviations in request rate or parameter entropy.
Review OpenEMR audit logs for EOB Data Entry role usage against directories unrelated to billing workflows.

How to Mitigate CVE-2026-76614

Immediate Actions Required

Upgrade OpenEMR to version 8.3.0 or later, which contains the fix committed in 7973cab3fe3f2fd2374ed71c02605e3c93491c36.
Review and restrict which accounts hold EOB Data Entry permissions to only those users who require them.
Audit recent EDI archive restore activity for signs of prior enumeration attempts.

Patch Information

The fix is included in OpenEMR Release v8.3.0. Details are available in the GitHub Security Advisory GHSA-gfwc-jg5p-jcp4 and the VulnCheck OpenEMR Path Traversal Advisory. The corresponding code change is in the GitHub Commit Update.

Workarounds

Temporarily remove EOB Data Entry permissions from non-essential accounts until patching is complete.
Restrict network access to the OpenEMR EDI archive restore endpoint through a reverse proxy or WAF rule that blocks traversal sequences.
Enforce multi-factor authentication on OpenEMR accounts to raise the cost of credential-based access.

bash

# Upgrade OpenEMR to the patched release
git fetch --tags
git checkout v8_3_0
# Follow the official upgrade procedure in the OpenEMR documentation before restarting services