Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, the DICOM zip/export feature uses a user-supplied destination or path component when creating the zip file, without sanitizing path traversal sequences (e.g. `../`). An attacker with DICOM upload/export permission can write files outside the intended directory, potentially under the web root, leading to arbitrary file write and possibly remote code execution if PHP or other executable files can be written. Version 8.0.0.2 fixes the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-19 | 1 | Disclosure1 |
| 2026-03-23 | 1 | General1 |
CVE-2026-25928 OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, the DICOM zip/export feature uses a user-su… https://www.cve.org/CVERecord?id=CVE-2026-25928
Post summary
The post simply references CVE-2026-25928 and links to its CVE record, offering no actionable or technical information about the vulnerability.
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-25928 - OpenEMR Vulnerable to Path Traversal When Zipping DICOM Folders Intel Report: https://ift.tt/jMivOV3
Post summary
Alert announcing CVE-2026-25928, a Path Traversal vulnerability in OpenEMR triggered when zipping DICOM folders, with a link to an Intel report.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | open-emr | openemr | - | - | - |