CVE-2026-63194 · Package
NO FIX YET · SEE WHAT TO DO
The bahmnicore OpenMRS module for Bahmni does not validate input paths during the admin CSV import process. An authenticated admin can write files to arbitrary locations on the server, which can lead to code execution.
first public Jul 2, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Deployments of the OpenMRS bahmnicore module (Bahmni core modules, including ERP and ELIS Atom Feed clients) at version 0.93 are exposed through the admin CSV import feature. Sites on other versions or without the CSV import in use are less exposed; the sources do not say more.
Not affected if patched-0.93.1-or-later
Who cares bahmni, java, openmrs, self-hosted
0.930.93.1OpenMRS module bahmnicore contains Core OpenMRS modules for Bahmni (including ERP & ELIS Atom Feed Clients). In version 0.93, there is insufficient validation of input paths during the admin CSV import process, allowing for potential arbitrary file write. This issue has been patched in version 0.93.1.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.