Vulnerability DatabaseCVE-2026-63194
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2026-63194
Published:November 11, 2026
Updated:November 12, 2026
OpenMRS module bahmnicore contains Core OpenMRS modules for Bahmni (including ERP & ELIS Atom Feed Clients). In version 0.93, there is insufficient validation of input paths during the admin CSV import process, allowing for potential arbitrary file write. This issue has been patched in version 0.93.1.
Affected Packages
https://github.com/Bahmni/bahmni-core.git (GITHUB):
Affected version(s) =1.3.0 <1.3.1
Fix Suggestion:
Update to version 1.3.1
https://github.com/Bahmni/bahmni-core.git (GITHUB):
Affected version(s) =1.2.0 <1.2.1
Fix Suggestion:
Update to version 1.2.1
https://github.com/Bahmni/bahmni-core.git (GITHUB):
Affected version(s) =2.0.0 <2.0.1
Fix Suggestion:
Update to version 2.0.1
org.bahmni.module:bahmnicore-omod (JAVA):
Affected version(s) =1.1.0 <1.1.1
Fix Suggestion:
Update to version 1.1.1
org.bahmni.module:bahmnicore-omod (JAVA):
Affected version(s) =2.0.0 <2.0.1
Fix Suggestion:
Update to version 2.0.1
org.bahmni.module:bahmnicore-omod (JAVA):
Affected version(s) =1.0.0 <1.0.1
Fix Suggestion:
Update to version 1.0.1
org.bahmni.module:bahmnicore-omod (JAVA):
Affected version(s) =1.3.0 <1.3.1
Fix Suggestion:
Update to version 1.3.1
org.bahmni.module:bahmnicore-omod (JAVA):
Affected version(s) =1.2.0 <1.2.1
Fix Suggestion:
Update to version 1.2.1
Related Resources (4)
Do you need more information?
Contact Us
CVSS v4
Base Score:
8.7
CVSS v3
Base Score:
7.5
Weakness Type (CWE)
Improper Limitation of a Pathname to a Restricted Directory
CWE-22