OpenMRS Core vulnerabilities

OpenMRS Core versions 2.7.8 and earlier and 2.8.0 through 2.8.5 are vulnerable to a Zip Slip attack that allows an attacker to upload malicious files. Due to improper path checking during the automatic extraction of .omod archives, files can be written outside the intended module directory.

In OpenMRS, from version 2.7.0 to before 2.7.9 and 2.8.6, the ConceptReferenceRangeUtility.evaluateCriteria() method evaluates database-stored criteria as Apache Velocity templates without proper sandbox configuration. This allows unrestricted Java reflection through template expressions.

OpenMRS Core up to version 2.7.8 and versions 2.8.0-2.8.5 contain a path traversal vulnerability in the `/openmrs/moduleResources/{moduleid}` endpoint. The getFile() function does not validate the path, allowing an unauthenticated attacker to read arbitrary files, including /etc/passwd and configuration files with database credentials. Exploitation is only possible on Apache Tomcat versions prior to 8.5.31.