Vulnerability · Published Aug 19, 2026 · Assigned by VulnCheck

CVE-2026-76614OpenEMR < 8.3.0 Path Traversal Information Disclosure via EDI Archive Restore

Medium 4.3

In plain English

A medium-severity path traversal in openemr from openemr. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.4%top 66.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

OpenEMR before 8.3.0 contains a path traversal vulnerability in the EDI archive restore function. The archrestore_sel POST parameter is passed to the archive restore handler without sanitization for path traversal sequences. The handler checks whether the supplied path exists on the filesystem, and the differing response messages leak whether the target path exists. An authenticated user with EOB Data Entry permissions can probe arbitrary filesystem paths on the server to determine file existence.

Affected products (as reported)

Vendor	Product	Versions
openemr	openemr	0 – before 8.3.0

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

GitHub Security Advisory (GHSA-gfwc-jg5p-jcp4) vendor-advisory
OpenEMR v8_3_0 Release Notes release-notes
Patch Commit patch
https://www.vulncheck.com/advisories/openemr-path-traversal-information-disclosure-via-edi-archive-restore third-party-advisory