Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.openmrs.api:openmrs-api

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.1MavenPublished

    OpenMRS has Stored Velocity SSTI to RCE via ConceptReferenceRange

    CVE-2026-41258 · GHSA-xj4f-8jjg-vx4q

    Affected
    • Maven org.openmrs.api:openmrs-api >= 2.7.0, < 2.7.9; >= 2.8.0, < 2.8.6
    Fixed in
    2.8.62.7.9· Vendor fix available
    Issue
    Impact The ConceptReferenceRangeUtility.evaluateCriteria() method in OpenMRS Core evaluates database-stored criteria strings as Apache Velocity templates without any sandbox configuration. The VelocityEngine is initialized with only logging properties and noSecureUberspector, leaving the default UberspectImpl in place, which allows unrestricted Java reflection through template expressions. A user with the Manage Concepts privilege can store a malicious Velocity template expression in a concept's reference range criteria field. This payload is then executed automatically whenever a user or API call validates an observation against the affected concept. The Velocity context exposes $patient (the Person / Patient object), $obs (the Obs object), and $fn (the ConceptReferenceRangeUtility instance with access to the full OpenMRS service layer). Persistent Remote Code Execution: The payload persists in the conceptreferencerange database table (VARCHAR 65535). A single compromised concept…

    Recommended action: Upgrade to 2.8.6 or 2.7.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →