CVE-2026-76614: 
OpenEMR vulnerability analysis and mitigation

CVE-2026-76614 is a path traversal vulnerability in OpenEMR's EDI archive restore function that enables authenticated users to enumerate arbitrary filesystem paths on the server. All OpenEMR versions before 8.3.0 are affected. The vulnerability was published on August 19, 2026, with a patch released in OpenEMR 8.3.0 on August 18, 2026. It carries a CVSS v3.1 base score of 4.3 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (GitHub Advisory, Feedly).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), arising from the failure to sanitize the archrestore_sel POST parameter before passing it to the edih_archive_restore() function in library/edihistory/edih_archive.php. The parameter is retrieved using FILTER_DEFAULT, which performs no path sanitization, and the resulting value is concatenated with the archive directory path and tested with PHP's is_file() without normalization — allowing ../ sequences to traverse outside the intended directory. The handler returns distinct response messages depending on whether the target path exists, creating an oracle that leaks filesystem structure. A secondary coding error (ZipArchive not closed before unlink()) currently prevents actual file deletion, but if that bug is fixed independently, the impact would escalate to arbitrary ZIP file deletion (GitHub Advisory).

Successful exploitation allows an authenticated attacker with Accounting – EOB Data Entry permissions to probe arbitrary filesystem paths on the OpenEMR server and determine whether specific files or directories exist, constituting an information disclosure risk. There is no direct impact on integrity or availability under current conditions; however, the disclosed filesystem layout could assist an attacker in chaining this vulnerability with others (e.g., identifying configuration files, credential stores, or backup archives) to escalate privileges or achieve deeper compromise. The vulnerability is particularly sensitive in healthcare environments where OpenEMR stores protected health information (PHI) (GitHub Advisory, Feedly).

No public proof-of-concept exploit code has been observed, and there is no evidence of active in-the-wild exploitation as of the disclosure date. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires valid credentials with EOB Data Entry permissions, limiting the attack surface to authenticated insiders or compromised accounts (Feedly).

1. Obtain credentials: Acquire valid OpenEMR credentials for an account with Accounting – EOB Data Entry permissions, either through phishing, credential stuffing, or insider access.
2. Authenticate: Log in to the target OpenEMR instance (version < 8.3.0) via the web interface.
3. Identify the vulnerable endpoint: Navigate to or directly target /interface/billing/edih_main.php, which handles EDI archive restore operations.
4. Craft the malicious POST request: Send a POST request to /interface/billing/edih_main.php with the parameters ArchiveRestore=restore and archrestore_sel=../../<target_path>, substituting <target_path> with the filesystem path to probe (e.g., Windows\win.ini or /etc/passwd).
5. Analyze the response: Compare the server's response message — a distinct message is returned depending on whether the traversed path exists on the filesystem, leaking file existence.
6. Iterate: Repeat with different path values to map the server's filesystem structure, identifying sensitive files such as configuration files, credential stores, or backup archives for use in further attacks (GitHub Advisory).

• Network: Repeated POST requests to /interface/billing/edih_main.php with ArchiveRestore=restore and archrestore_sel values containing path traversal sequences (e.g., ../, ..\, URL-encoded variants %2e%2e%2f).
• Logs: Web server access logs showing POST requests to /interface/billing/edih_main.php from a single authenticated session with varying archrestore_sel values targeting paths outside the expected archive directory; unusual volume of requests to this endpoint from a single user account.
• Application Logs: OpenEMR application logs showing repeated invocations of edih_archive_restore() with non-standard filename arguments that include directory separator sequences.

Upgrade OpenEMR to version 8.3.0 or later, which includes the fix applied in commit 7973cab3fe3f2fd2374ed71c02605e3c93491c36 that sanitizes the archrestore_sel parameter in library/edihistory/edih_io.php (OpenEMR Release, Fix Commit). As an interim workaround where immediate upgrade is not possible, restrict the Accounting – EOB Data Entry permission to only fully trusted users, and consider blocking external network access to /interface/billing/edih_main.php via web server configuration or a WAF rule. Implementing input validation to reject path traversal sequences in the archrestore_sel parameter at the application layer is also recommended (GitHub Advisory).