CVE-2026-41258 Details
Description
OpenMRS is an open source electronic medical record system platform. From 2.7.0 to before 2.7.9 and 2.8.6, the ConceptReferenceRangeUtility.evaluateCriteria() method in OpenMRS Core evaluates database-stored criteria strings as Apache Velocity templates without any sandbox configuration. The VelocityEngine is initialized with only logging properties and noSecureUberspector, leaving the default UberspectImpl in place, which allows unrestricted Java reflection through template expressions. A user with the Manage Concepts privilege can store a malicious Velocity template expression in a concept's reference range criteria field. This payload is then executed automatically whenever a user or API call validates an observation against the affected concept. The Velocity context exposes $patient (the Person / Patient object), $obs (the Obs object), and $fn (the ConceptReferenceRangeUtility instance with access to the full OpenMRS service layer). This vulnerability is fixed in 2.7.9 and 2.8.6.
A critical vulnerability exists in OpenMRS versions 2.7.0 prior to 2.7.9 and 2.8.0 prior to 2.8.6. The issue arises in the ConceptReferenceRangeUtility.evaluateCriteria() method, which processes database-stored criteria strings as Apache Velocity templates without proper sandboxing. The VelocityEngine is configured only for logging, lacking a SecureUberspector, and allowing unrestricted Java reflection through template expressions. Users with the Manage Concepts privilege can inject malicious Velocity template expressions into a concept's reference range criteria. These payloads are executed automatically when validating observations against the affected concept, exposing patient data and potentially leading to arbitrary code execution on the server.
Users should update to OpenMRS versions 2.7.9 or 2.8.6. It is also recommended to restrict the Manage Concepts privilege to authorized users and audit ConceptReferenceRanges in the database.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 15, 2026CISA-ADP
Assessed May 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/openmrs/openmrs-core/security/advisories/GHSA-xj4f-8jjg-vx4q | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OpenMRS | >= 2.7.0, < 2.7.9 (semver) >= 2.8.0, < 2.8.6 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 15, 2026 | New CVE Received | [email protected] |