CVE-2026-40076: 
Java vulnerability analysis and mitigation

CVE-2026-40076 is a Zip Slip path traversal vulnerability in OpenMRS Core, an open-source electronic medical record system platform. The flaw exists in the module upload endpoint (POST /openmrs/ws/rest/v1/module) and allows authenticated attackers with module upload access to write arbitrary files outside the intended directory, potentially achieving remote code execution. Affected versions include OpenMRS Core ≤ 2.7.8 and 2.8.0 through 2.8.5. The vulnerability was published on May 4, 2026, and assigned CVSS v3.1 score of 8.8 (High) and CVSS v4.0 score of 9.4 (Critical) (GitHub Advisory, OpenMRS Advisory).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) in WebModuleUtil.startModule() within web/src/main/java/org/openmrs/module/web/WebModuleUtil.java. The existing path check — Paths.get(name).startsWith("..") — only blocks ZIP entries whose names begin with ..; an entry named web/module/foo/../../../../evil.jsp starts with web, bypassing the check entirely. After stripping the web/module/ prefix via name.substring(11), the remaining path is concatenated into the destination without normalization or boundary validation, allowing traversal outside WEB-INF/view/module/. Notably, other extraction methods in the same codebase (ModuleUtil.expandJar(), TestInstallUtil.addZippedTestModules()) correctly use normalize().startsWith() checks — this is an oversight in WebModuleUtil.startModule(). Additionally, the module.allow_web_admin runtime property that is intended to block web-based module administration is enforced only in the Legacy UI controller (ModuleListController) and not in the REST API path, allowing attackers to bypass this control entirely (OpenMRS Advisory).

Successful exploitation allows an authenticated attacker with module upload privileges to write arbitrary files to any location accessible by the application server process, including the web application root (e.g., /usr/local/tomcat/webapps/openmrs/). By writing a JSP web shell to the web root and then requesting it via a browser, the attacker achieves remote code execution with the privileges of the Tomcat/application server process. This results in full compromise of confidentiality, integrity, and availability of the affected system, and may enable lateral movement within the network or access to sensitive patient medical records (OpenMRS Advisory, GitHub Advisory).

A proof-of-concept exploit with step-by-step instructions is publicly documented in the official security advisory, including the specific REST API endpoint, archive construction technique, and JSP-based RCE payload delivery mechanism (OpenMRS Advisory). Exploitation requires valid credentials with module upload access (low-privilege relative to admin), but the module.allow_web_admin bypass means deployments that rely on that property for access control remain exposed. There is no current evidence of in-the-wild exploitation. The EPSS score is approximately 0.124% (31st percentile), and the vulnerability is not listed in the CISA KEV catalog as of the time of this report (GitHub Advisory).

1. Reconnaissance: Identify internet-facing OpenMRS instances running versions ≤ 2.7.8 or 2.8.0–2.8.5. Confirm the REST API is accessible at /openmrs/ws/rest/v1/module.
2. Obtain credentials: Acquire valid credentials for an account with module upload access (admin-level or equivalent). Note that the module.allow_web_admin property does not block the REST API path, so even deployments with this restriction enabled are vulnerable.
3. Craft malicious .omod archive: Create a ZIP/JAR archive (.omod file) containing a ZIP entry with a path traversal payload in its entry name, such as web/module/../../../../malicious.jsp. The JSP payload should contain a web shell (e.g., executing OS commands via Runtime.exec()).
4. Upload the archive: Send an HTTP POST request to POST /openmrs/ws/rest/v1/module with valid admin credentials via Basic Auth and the crafted .omod file as the request body.
5. Trigger extraction: The server parses and loads the module. During WebModuleUtil.startModule(), entries under web/module/ are automatically extracted. The incomplete Paths.get(name).startsWith("..") check passes for the crafted entry, and the traversal sequences cause the JSP file to be written to the web application root (e.g., /usr/local/tomcat/webapps/openmrs/malicious.jsp).
6. Achieve RCE: Access the uploaded JSP file via the browser (e.g., https://target/openmrs/malicious.jsp), triggering server-side execution and establishing a web shell for arbitrary command execution (OpenMRS Advisory).

• Network: Unusual HTTP POST requests to /openmrs/ws/rest/v1/module with multipart/form-data bodies containing .omod files from unexpected source IPs; subsequent GET requests to unexpected .jsp files under the /openmrs/ web root.
• File System: Unexpected .jsp or other script files appearing in the web application root (e.g., /usr/local/tomcat/webapps/openmrs/) or other directories outside WEB-INF/view/module/; newly created files with names not matching any legitimate installed module.
• Logs: Application server access logs showing POST requests to /openmrs/ws/rest/v1/module followed by GET requests to newly created JSP files; Java stack traces or UnsupportedOperationException messages in OpenMRS logs related to module extraction (if partial mitigations are in place).
• Process: Unusual child processes spawned by the Tomcat/Java process (e.g., bash, sh, curl, wget, python) indicating web shell command execution (OpenMRS Advisory).

Update OpenMRS Core to a patched version: versions after 2.7.8 in the 2.7.x line, or version 2.8.6 or later in the 2.8.x line. As an immediate workaround, restrict network access to the POST /openmrs/ws/rest/v1/module REST API endpoint to trusted administrators only (e.g., via firewall rules or reverse proxy ACLs). If patching cannot be performed immediately, consider disabling module upload functionality through the REST API entirely. Note that relying solely on the module.allow_web_admin runtime property is insufficient, as it does not protect the REST API endpoint (OpenMRS Advisory, GitHub Advisory).

The vulnerability was reported by security researcher Arron-bit and published by OpenMRS maintainer ibacher on May 4, 2026. The advisory notes that the fix pattern (normalize().startsWith()) was already correctly applied in other parts of the codebase, making this an oversight rather than a systemic design flaw. No significant broader media coverage or notable community commentary beyond the official advisory has been identified at this time (OpenMRS Advisory).