TI-2026-29866 Aliases CVE-2026-41258 GHSA-xj4f-8jjg-vx4q

OpenMRS: Stored Velocity SSTI to RCE via ConceptReferenceRange

MEDIUM 41CWE-94Published 2026-05-15 · Updated 2026-05-15

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-94.

Summary

OpenMRS is an open source electronic medical record system platform. From 2.7.0 to before 2.7.9 and 2.8.6, the ConceptReferenceRangeUtility.evaluateCriteria() method in OpenMRS Core evaluates database-stored criteria strings as Apache Velocity templates without any sandbox configuration. The VelocityEngine is initialized with only logging properties and noSecureUberspector, leaving the default UberspectImpl in place, which allows unrestricted Java reflection through template expressions. A user with the Manage Concepts privilege can store a malicious Velocity template expression in a concept's reference range criteria field. This payload is then executed automatically whenever a user or API call validates an observation against the affected concept. The Velocity context exposes $patient (the Person / Patient object), $obs (the Obs object), and $fn (the ConceptReferenceRangeUtility instance with access to the full OpenMRS service layer). This vulnerability is fixed in 2.7.9 and 2.8.6.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00317 24th percentileScored 2026-11-07

Fix Fixed org.openmrs.api:openmrs-api (Maven): 2.7.9, 2.8.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
OpenMRS	openmrs-core	>= 2.7.0 < 2.7.9; >= 2.8.0 < 2.8.6	—	No fix listed	CNA
—	org.openmrs.api:openmrs-api (Maven)	2.7.0 to before 2.7.9	2.7.9	Patch available	GHSA-xj4f-8jjg-vx4q
—	org.openmrs.api:openmrs-api (Maven)	2.8.0 to before 2.8.6	2.8.6	Patch available	GHSA-xj4f-8jjg-vx4q

openmrs-core VendorOpenMRS Affected >= 2.7.0 < 2.7.9; >= 2.8.0 < 2.8.6 Fixed in — No fix listed CNA
org.openmrs.api:openmrs-api (Maven) Vendor— Affected 2.7.0 to before 2.7.9 Fixed in 2.7.9 Patch available GHSA-xj4f-8jjg-vx4q
org.openmrs.api:openmrs-api (Maven) Vendor— Affected 2.8.0 to before 2.8.6 Fixed in 2.8.6 Patch available GHSA-xj4f-8jjg-vx4q

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:openmrs:openmrs::::::::	—	—	OpenMRS

cpe:2.3:a:openmrs:openmrs:*:*:*:*:*:*:*:* Versions — — ·OpenMRS

Remediation

Fix · GHSA-xj4f-8jjg-vx4q org.openmrs.api:openmrs-api (Maven) Fixed in 2.7.9 Advisory →
Fix · GHSA-xj4f-8jjg-vx4q org.openmrs.api:openmrs-api (Maven) Fixed in 2.8.6 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-41258
2026-10-03 Alias added: GHSA-xj4f-8jjg-vx4q

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-41258

Other 4

TI-2018-13666 OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability… CVSS 3.1CRITICAL 9.8
TI-2026-28907 OpenMRS Core arbitrary file write and code execution via Zip Slip in module upload CVSS 4.0CRITICAL 9.4
TI-2026-28906 OpenMRS Core arbitrary file read via path traversal in ModuleResourcesServlet CVSS 4.0HIGH 8.2
TI-2022-07665 Directory Traversal in OpenMRS Startup Filter CVSS 3.1HIGH 7.5
TI-2025-19183 A Cross-Site Request Forgery (CSRF) in the component /admin/users/user.form of Openmrs… CVSS 3.1HIGH 8.0
TI-2025-19182 A Cross-Site Request Forgery (CSRF) in Openmrs 2.4.3 Build 0ff0ed allows attackers to… CVSS 3.1MEDIUM 6.8

See all 33 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences