CVE-2026-76614: 
OpenEMR vulnerability analysis and mitigation

CVE-2026-76614 is a path traversal vulnerability in OpenEMR's EDI archive restore function that allows authenticated users to enumerate arbitrary filesystem paths on the server. All OpenEMR versions before 8.3.0 are affected. The vulnerability was published on August 19, 2026, with a patch released in OpenEMR 8.3.0 on August 18, 2026. It carries a CVSS v3.1 base score of 4.3 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (GitHub Advisory, Github Advisory).

The root cause is improper input sanitization (CWE-22) in /interface/billing/edih_main.php. When ArchiveRestore=restore is POSTed to this endpoint, the archrestore_sel parameter is retrieved using FILTER_DEFAULT — which performs no path traversal sanitization — and passed directly to edih_archive_restore() in library/edihistory/edih_archive.php. That function concatenates the user-supplied value with the archive directory path and calls is_file() on the result without normalizing the path, allowing ../ sequences to escape the intended directory. The function returns distinct response messages depending on whether the target path exists, creating an oracle that leaks filesystem structure. A secondary coding error (ZipArchive not closed before unlink()) currently prevents actual file deletion, but if that bug is fixed independently, the impact would escalate to arbitrary ZIP file deletion (GitHub Advisory).

Successful exploitation allows an authenticated attacker with EOB Data Entry permissions to determine the existence of arbitrary files and directories anywhere on the server's filesystem by observing differing HTTP response messages. This information disclosure could aid in reconnaissance for further attacks — for example, confirming the presence of sensitive configuration files, credential stores, or backup archives. There is no direct integrity or availability impact under the current code, but if the related ZipArchive coding error is corrected without simultaneously fixing the path traversal, the vulnerability could escalate to arbitrary ZIP file deletion (GitHub Advisory, Github Advisory).

A proof-of-concept Python script (PLT-2026-05-04.py) was referenced in the official security advisory and used by the reporter to demonstrate exploitation, indicating PoC code exists. The NVD SSVC assessment classifies exploitation status as "poc." There is no evidence of active in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.274% (19th percentile), reflecting a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory, Github Advisory).

1. Obtain credentials: Acquire valid OpenEMR credentials for an account with Accounting - EOB Data Entry permissions (a relatively low-privilege role).
2. Authenticate: Log in to the target OpenEMR instance (version < 8.3.0) to establish an authenticated session.
3. Identify the vulnerable endpoint: Target /interface/billing/edih_main.php, which handles EDI archive restore operations.
4. Craft the traversal payload: Construct an HTTP POST request with ArchiveRestore=restore and set archrestore_sel to a path traversal sequence pointing to a target file, e.g., archrestore_sel=../../../../Windows/win.ini or archrestore_sel=../../../../etc/passwd.
5. Send the request and observe the response: Submit the POST request. If the target path exists, the server returns one response message; if it does not exist, a different message is returned. This difference acts as a boolean oracle.
6. Enumerate filesystem paths: Iterate over candidate paths using the PoC script (PLT-2026-05-04.py) or a custom tool, systematically probing for sensitive files (configuration files, credential stores, backup archives) to build a map of the server's filesystem for use in follow-on attacks (GitHub Advisory).

• Network: Repeated HTTP POST requests to /interface/billing/edih_main.php with ArchiveRestore=restore in the body, particularly from a single authenticated session in rapid succession; archrestore_sel values containing ../ sequences or absolute paths outside the expected archive directory.
• Logs: Web server access logs showing multiple POST requests to /interface/billing/edih_main.php with varying archrestore_sel values; application logs recording is_file() checks against paths outside the EDI archive directory.
• Behavior: An EOB Data Entry user account generating an unusually high volume of requests to the EDI archive restore endpoint in a short time window, consistent with automated path enumeration.

Upgrade OpenEMR to version 8.3.0 or later, which includes the fix applied in commit 7973cab3fe3f2fd2374ed71c02605e3c93491c36 that adds proper input handling for the archrestore_sel parameter (OpenEMR Release, Fix Commit). As interim mitigations, restrict EOB Data Entry permissions to only fully trusted users, and implement network-level controls (e.g., WAF rules) to block POST requests to /interface/billing/edih_main.php containing path traversal sequences (../, ..\) in the archrestore_sel parameter (GitHub Advisory).