CVE-2026-41258

{
  "id": "CVE-2026-41258",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-15T17:16:46.463",
  "lastModified": "2026-10-26T14:10:00.130",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenMRS is an open source electronic medical record system platform. From 2.7.0 to before 2.7.9 and 2.8.6, the ConceptReferenceRangeUtility.evaluateCriteria() method in OpenMRS Core evaluates database-stored criteria strings as Apache Velocity templates without any sandbox configuration. The VelocityEngine is initialized with only logging properties and noSecureUberspector, leaving the default UberspectImpl in place, which allows unrestricted Java reflection through template expressions. A user with the Manage Concepts privilege can store a malicious Velocity template expression in a concept's reference range criteria field. This payload is then executed automatically whenever a user or API call validates an observation against the affected concept. The Velocity context exposes $patient (the Person / Patient object), $obs (the Obs object), and $fn (the ConceptReferenceRangeUtility instance with access to the full OpenMRS service layer). This vulnerability is fixed in 2.7.9 and 2.8.6."
    },
    {
      "lang": "es",
      "value": "OpenMRS es una plataforma de sistema de registro médico electrónico de código abierto. Desde la 2.7.0 hasta antes de la 2.7.9 y la 2.8.6, el método ConceptReferenceRangeUtility.evaluateCriteria() en OpenMRS Core evalúa cadenas de criterios almacenadas en la base de datos como plantillas de Apache Velocity sin ninguna configuración de sandbox. El VelocityEngine se inicializa solo con propiedades de registro y noSecureUberspector, dejando el UberspectImpl predeterminado en su lugar, lo que permite la reflexión Java sin restricciones a través de expresiones de plantilla. Un usuario con el privilegio Gestionar Conceptos puede almacenar una expresión de plantilla Velocity maliciosa en el campo de criterios de rango de referencia de un concepto. Esta carga útil se ejecuta automáticamente cada vez que un usuario o una llamada a la API valida una observación contra el concepto afectado. El contexto de Velocity expone $patient (el objeto Persona / Paciente), $obs (el objeto Obs) y $fn (la instancia de ConceptReferenceRangeUtility con acceso a la capa de servicio completa de OpenMRS). Esta vulnerabilidad se corrige en las versiones 2.7.9 y 2.8.6."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "openmrs",
          "product": "openmrs-core",
          "versions": [
            {
              "version": ">= 2.7.0 < 2.7.9",
              "status": "affected"
            },
            {
              "version": ">= 2.8.0 < 2.8.6",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-15T16:39:58.631532Z",
          "id": "CVE-2026-41258",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/openmrs/openmrs-core/security/advisories/GHSA-xj4f-8jjg-vx4q",
      "source": "[email protected]"
    }
  ]
}