---
id: "CVE-2026-63194"
page: "https://infrastack.ai/live/CVE-2026-63194"
kind: "vulnerability"
aliases: ["CVE-2026-63194"]
title: "OpenMRS bahmnicore: admin CSV import allows arbitrary file write"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["bahmni", "java", "openmrs", "package", "self-hosted"]
not_affected_if: ["patched-0.93.1-or-later"]
published_at: "2026-11-11T03:16:52+00:00"
first_seen_at: "2026-11-11T03:25:00+00:00"
updated_at: "2026-11-11T03:26:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63194", "first_seen_at": "2026-11-11T03:25:00+00:00"}]
exploit_sources: []
---

# OpenMRS bahmnicore: admin CSV import allows arbitrary file write

Link for people: https://infrastack.ai/live/CVE-2026-63194 (this .md is for agents)

The bahmnicore OpenMRS module for Bahmni does not validate input paths during the admin CSV import process. An authenticated admin can write files to arbitrary locations on the server, which can lead to code execution.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the bahmnicore module version in the OpenMRS deployment; affected version is `0.93`
- Look for the bahmnicore module in the OpenMRS modules directory or running module list

## Fix

- bahmnicore: move to `0.93.1`

## Timeline

- 2026-11-11T03:25:00+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-63194

## Documents

- [advisory] Vendor advisory: github.com https://github.com/Bahmni/bahmni-core/security/advisories/GHSA-pmw7-2mfv-4592

## From the sources

OpenMRS module bahmnicore contains Core OpenMRS modules for Bahmni (including ERP & ELIS Atom Feed Clients). In version 0.93, there is insufficient validation of input paths during the admin CSV import process, allowing for potential arbitrary file write. This issue has been patched in version 0.93.1.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_