CVE-2026-25928— OpenEMR 路径遍历漏洞

OpenEMR Vulnerable to Path Traversal When Zipping DICOM Folders

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, the DICOM zip/export feature uses a user-supplied destination or path component when creating the zip file, without sanitizing path traversal sequences (e.g. `../`). An attacker with DICOM upload/export permission can write files outside the intended directory, potentially under the web root, leading to arbitrary file write and possibly remote code execution if PHP or other executable files can be written. Version 8.0.0.2 fixes the issue.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

对路径名的限制不恰当(路径遍历)

OpenEMR 路径遍历漏洞

OpenEMR是OpenEMR社区的一套开源的医疗管理系统。该系统可用于医疗实践管理、电子医疗记录、处方书写和医疗帐单申请。 OpenEMR 8.0.0.2之前版本存在路径遍历漏洞，该漏洞源于DICOM zip/export功能未清理路径遍历序列，可能导致具有DICOM上传/导出权限的攻击者执行任意文件写入和远程代码执行。

N/A

N/A