CVE-2026-40075

{"id": "CVE-2026-40075", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40075", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-06T14:32:34.742099Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "openmrs", "product": "openmrs-core", "versions": [{"status": "affected", "version": "<= 2.7.8"}, {"status": "affected", "version": ">= 2.8.0, <= 2.8.5"}]}]}], "published": "2026-05-05T22:16:00.520", "references": [{"url": "https://github.com/openmrs/openmrs-core/security/advisories/GHSA-jjgj-cx3q-pw4w", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/openmrs/openmrs-core/security/advisories/GHSA-jjgj-cx3q-pw4w", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "OpenMRS Core is an open source electronic medical record system platform. In versions 2.7.8 and earlier and versions 2.8.0 through 2.8.5, the `/openmrs/moduleResources/{moduleid}` endpoint is vulnerable to a path traversal attack. The ModuleResourcesServlet constructs a filesystem path from user-controlled input without performing path boundary validation \u2014 the getFile() method concatenates the user-supplied path into an absolute filesystem path without calling normalize() or checking that the result stays within the allowed module resources directory. Because this endpoint serves static resources required for rendering the login page, it is not protected by authentication filters, allowing unauthenticated exploitation.\n\nAn attacker can traverse directories and read arbitrary files from the server filesystem, including /etc/passwd and application configuration files containing database credentials. Successful exploitation requires the target deployment to run on Apache Tomcat versions prior to 8.5.31, where the ..; path parameter bypass is not mitigated by the container. Deployments on Tomcat 8.5.31 or later and Tomcat 9.0.10 or later are protected at the container level, though the underlying code defect remains. This issue has been fixed in versions after 2.7.8 (within the 2.7.x branch) and in version 2.8.6 and later."}, {"lang": "es", "value": "OpenMRS Core es una plataforma de sistema de registro m\u00e9dico electr\u00f3nico de c\u00f3digo abierto. En las versiones 2.7.8 y anteriores, y en las versiones 2.8.0 a 2.8.5, el endpoint '/openmrs/moduleResources/{moduleid}' es vulnerable a un ataque de salto de ruta. El ModuleResourcesServlet construye una ruta del sistema de archivos a partir de una entrada controlada por el usuario sin realizar una validaci\u00f3n de l\u00edmites de ruta - el m\u00e9todo getFile() concatena la ruta proporcionada por el usuario en una ruta absoluta del sistema de archivos sin llamar a normalize() ni verificar que el resultado permanezca dentro del directorio de recursos del m\u00f3dulo permitido. Debido a que este endpoint sirve recursos est\u00e1ticos necesarios para renderizar la p\u00e1gina de inicio de sesi\u00f3n, no est\u00e1 protegido por filtros de autenticaci\u00f3n, lo que permite la explotaci\u00f3n no autenticada.\n\nUn atacante puede atravesar directorios y leer archivos arbitrarios del sistema de archivos del servidor, incluyendo /etc/p4ssd y archivos de configuraci\u00f3n de aplicaciones que contienen credenciales de base de datos. La explotaci\u00f3n exitosa requiere que la implementaci\u00f3n objetivo se ejecute en versiones de Apache Tomcat anteriores a la 8.5.31, donde el bypass del par\u00e1metro de ruta '..;' no es mitigado por el contenedor. Las implementaciones en Tomcat 8.5.31 o posterior y Tomcat 9.0.10 o posterior est\u00e1n protegidas a nivel de contenedor, aunque el defecto de c\u00f3digo subyacente permanece. Este problema ha sido solucionado en versiones posteriores a la 2.7.8 (dentro de la rama 2.7.x) y en la versi\u00f3n 2.8.6 y posteriores."}], "lastModified": "2026-07-24T21:10:00.143", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openmrs:openmrs:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "36ECEBBA-4717-41A7-9BA3-A3F91085CC7D", "versionEndIncluding": "2.7.8"}, {"criteria": "cpe:2.3:a:openmrs:openmrs:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3ECCD1F7-883D-47F2-A8F7-939CD497EC86", "versionEndIncluding": "2.8.5", "versionStartIncluding": "2.8.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}