CVE-2026-40075: 
Java vulnerability analysis and mitigation

CVE-2026-40075 is a path traversal vulnerability in OpenMRS Core's ModuleResourcesServlet that allows unauthenticated attackers to read arbitrary files from the server filesystem. It affects OpenMRS Core versions ≤ 2.7.8 and versions 2.8.0 through 2.8.5. The vulnerability was published on May 4, 2026, by researcher Arron-bit, and added to the NVD on May 5, 2026. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.2 (High) (GitHub Advisory, OpenMRS Advisory).

The root cause (CWE-22: Improper Limitation of a Pathname to a Restricted Directory) lies in ModuleResourcesServlet.java, where the getFile() method constructs a filesystem path by concatenating user-controlled input without calling normalize() or verifying the result stays within the allowed module resources directory. The helper ModuleUtil.getPathForResource() only strips the module ID prefix and returns the unsanitized remainder, allowing sequences like ../../../../../../etc/passwd to resolve outside the web application root. Because the /openmrs/moduleResources/{moduleid} endpoint serves static resources needed for the login page, it bypasses authentication filters entirely — enabling unauthenticated network exploitation. Exploitation additionally requires the target to run on Apache Tomcat prior to 8.5.31 (or 9.0.10), where the ..; path parameter bypass is not blocked at the container level; newer Tomcat versions mitigate the bypass technique but do not fix the underlying code defect (GitHub Advisory, OpenMRS Advisory).

Successful exploitation allows an unauthenticated remote attacker to read arbitrary files from the server filesystem, including sensitive system files such as /etc/passwd and application configuration files that may contain database credentials. The confidentiality impact is high, as exposed database credentials could enable further lateral movement into backend databases containing patient health records — a critical concern given OpenMRS is an electronic medical record platform used in healthcare settings. Integrity and availability are not directly impacted by this vulnerability (GitHub Advisory, OpenMRS Advisory).

The GitHub Security Advisory includes explicit step-by-step exploitation instructions with a working HTTP request example (e.g., /openmrs/moduleResources/legacyui/../../../../../../etc/passwd), which Feedly's threat intelligence classifies as a real exploit with high confidence. No evidence of active in-the-wild exploitation has been reported as of the time of disclosure, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.085% (26th percentile), indicating a currently low but non-negligible probability of exploitation in the near term (OpenMRS Advisory, GitHub Advisory).

1. Reconnaissance: Identify internet-facing OpenMRS instances running versions ≤ 2.7.8 or 2.8.0–2.8.5 on Apache Tomcat < 8.5.31 or < 9.0.10, using tools like Shodan or Censys searching for OpenMRS login pages.
2. Identify a valid module ID: Browse the OpenMRS login page or probe common module IDs (e.g., legacyui, webservices.rest) that are typically installed by default.
3. Craft the traversal request: Construct an HTTP GET request to the unauthenticated endpoint using the ..; path traversal technique:

   GET /openmrs/moduleResources/legacyui/../../../../../../etc/passwd HTTP/1.1
   Host: <target>

4. Read arbitrary files: The server responds with HTTP 200 and the contents of the targeted file (e.g., /etc/passwd). Repeat with paths to OpenMRS configuration files (e.g., openmrs-runtime.properties) to extract database credentials.
5. Escalate access: Use harvested database credentials to connect directly to the backend database and access or exfiltrate patient health records or other sensitive data (OpenMRS Advisory, GitHub Advisory).

• Network: Unusual HTTP GET requests to /openmrs/moduleResources/ containing ../ or ..;/ sequences in the path; requests from unexpected source IPs targeting the moduleResources endpoint without prior authenticated session activity.
• Logs: Web server or Tomcat access logs showing requests matching the pattern /openmrs/moduleResources/<moduleid>/../../ returning HTTP 200 responses with unexpectedly large or text-based response bodies; requests for paths resolving outside the webapp directory (e.g., /etc/passwd, openmrs-runtime.properties).
• File System: No direct file system artifacts are created by read-only exploitation, but unexpected outbound connections from the OpenMRS server following such requests may indicate credential harvesting and follow-on activity.
• Process: Unexpected database connection attempts from new or external IP addresses following exploitation, potentially indicating use of harvested credentials (OpenMRS Advisory).

Upgrade OpenMRS Core to a patched version: any release after 2.7.8 within the 2.7.x branch, or version 2.8.6 or later in the 2.8.x branch. As a secondary mitigation, ensure the deployment runs on Apache Tomcat 8.5.31 or later (or Tomcat 9.0.10 or later), which blocks the ..; path parameter bypass at the container level — though this does not fix the underlying code defect. Organizations unable to upgrade immediately should consider placing a web application firewall (WAF) rule to block requests to /openmrs/moduleResources/ containing path traversal sequences (../, ..;/) (GitHub Advisory, OpenMRS Advisory).

The vulnerability was reported by researcher Arron-bit and published by OpenMRS maintainer ibacher on May 4, 2026. A technical write-up was published by Infinit Security covering the arbitrary file read via path traversal in ModuleResourcesServlet. Social media activity was observed on Bluesky shortly after disclosure. No major vendor statements beyond the official advisory or significant mainstream media coverage have been identified (GitHub Advisory).