{"id":"CVE-2026-63194","kind":"vulnerability","aliases":["CVE-2026-63194"],"related":[],"title":"OpenMRS bahmnicore: admin CSV import allows arbitrary file write","description":"OpenMRS module bahmnicore contains Core OpenMRS modules for Bahmni (including ERP & ELIS Atom Feed Clients). In version 0.93, there is insufficient validation of input paths during the admin CSV import process, allowing for potential arbitrary file write. This issue has been patched in version 0.93.1.","summary":"The bahmnicore OpenMRS module for Bahmni does not validate input paths during the admin CSV import process. An authenticated admin can write files to arbitrary locations on the server, which can lead to code execution.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bahmni","java","openmrs","package","self-hosted"],"not_affected_if":["patched-0.93.1-or-later"],"how_to_check":"- Check the bahmnicore module version in the OpenMRS deployment; affected version is `0.93`\n- Look for the bahmnicore module in the OpenMRS modules directory or running module list","fix":"- bahmnicore: move to `0.93.1`","status":"open","published_at":"2026-11-11T03:16:52+00:00","first_seen_at":"2026-11-11T03:25:00+00:00","triaged_at":"2026-11-11T03:26:17+00:00","updated_at":"2026-11-11T03:26:17+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-11T03:26:17Z","model":"claude-haiku-5-5","output":{"fix":"- bahmnicore: move to `0.93.1`","reach":"network","title":"OpenMRS bahmnicore: admin CSV import allows arbitrary file write","impact":"high","summary":"The bahmnicore OpenMRS module for Bahmni does not validate input paths during the admin CSV import process. An authenticated admin can write files to arbitrary locations on the server, which can lead to code execution.","audience":"businesses","category":"package","nicknames":[],"who_cares":["openmrs","bahmni","self-hosted","java"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"attacker writes arbitrary files on the server, possibly running code","analyst_note":"","how_to_check":"- Check the bahmnicore module version in the OpenMRS deployment; affected version is `0.93`\n- Look for the bahmnicore module in the OpenMRS modules directory or running module list","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["patched-0.93.1-or-later"],"who_is_affected":"Deployments of the OpenMRS bahmnicore module (Bahmni core modules, including ERP and ELIS Atom Feed clients) at version 0.93 are exposed through the admin CSV import feature. Sites on other versions or without the CSV import in use are less exposed; the sources do not say more.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00072,"input_tokens":4591,"output_tokens":521,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-63194':12A,15A '0.93':75C '0.93.1':102C 'admin':3A,36B,42B,85C 'allow':6A,89C 'arbitrari':7A,47B,92C 'atom':70C 'authent':41B 'bahmni':16B,28B,66C 'bahmnicor':2A,24B,60C 'client':72C 'code':56B 'contain':61C 'core':62C 'csv':4A,37B,86C 'cve':10A,13A 'eli':69C 'erp':68C 'execut':57B 'feed':71C 'file':8A,45B,93C 'host':22B 'import':5A,38B,87C 'includ':67C 'input':32B,81C 'insuffici':78C 'issu':96C 'java':17B 'lead':54B 'locat':48B 'modul':26B,59C,64C 'openmr':1A,18B,25B,58C,63C 'packag':19B 'patch':99C 'path':33B,82C 'potenti':91C 'process':39B,88C 'self':21B 'self-host':20B 'server':51B 'valid':31B,79C 'version':74C,101C 'write':9A,44B,94C","nicknames":[],"mitigations":[],"who_affected":"Deployments of the OpenMRS bahmnicore module (Bahmni core modules, including ERP and ELIS Atom Feed clients) at version 0.93 are exposed through the admin CSV import feature. Sites on other versions or without the CSV import in use are less exposed; the sources do not say more.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["bahmni","high","java","openmrs","package","selfhosted"],"campaign_type":null,"search_a":"'-2026':11A,14A '-63194':12A,15A 'admin':3A 'allow':6A 'arbitrari':7A 'bahmnicor':2A 'csv':4A 'cve':10A,13A 'file':8A 'import':5A 'openmr':1A 'write':9A","search_b":"'admin':36B,42B 'arbitrari':47B 'authent':41B 'bahmni':16B,28B 'bahmnicor':24B 'code':56B 'csv':37B 'execut':57B 'file':45B 'host':22B 'import':38B 'input':32B 'java':17B 'lead':54B 'locat':48B 'modul':26B 'openmr':18B,25B 'packag':19B 'path':33B 'process':39B 'self':21B 'self-host':20B 'server':51B 'valid':31B 'write':44B","search_c":"'0.93':75C '0.93.1':102C 'admin':85C 'allow':89C 'arbitrari':92C 'atom':70C 'bahmni':66C 'bahmnicor':60C 'client':72C 'contain':61C 'core':62C 'csv':86C 'eli':69C 'erp':68C 'feed':71C 'file':93C 'import':87C 'includ':67C 'input':81C 'insuffici':78C 'issu':96C 'modul':59C,64C 'openmr':58C,63C 'patch':99C 'path':82C 'potenti':91C 'process':88C 'valid':79C 'version':74C,101C 'write':94C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-02T09:04:46+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-63194","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63194","severity":null,"published_at":"2026-11-11T03:16:52+00:00","modified_at":"2026-11-11T03:16:52+00:00","first_seen_at":"2026-11-11T03:25:00+00:00","fetched_at":"2026-11-11T03:25:00+00:00","note":null}],"documents":[{"id":122065,"url":"https://github.com/Bahmni/bahmni-core/security/advisories/GHSA-pmw7-2mfv-4592","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-02T09:04:46+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}