CVE-2026-41258: OpenMRS Core: Stored Velocity SSTI to RCE via ConceptReferenceRange
OpenMRS Core evaluates criteria strings stored in concept reference ranges as Apache Velocity templates without a sandbox, which the record classifies as CWE-94 code injection. A user with the Manage Concepts privilege can store malicious template content that runs automatically during observation validation. The issue is fixed in 2.7.9 and 2.8.6, and the record shows no KEV listing or confirmed exploitation.
Overview
CVE-2026-41258 affects OpenMRS Core, the core platform of the open source electronic medical record system. The record classifies it as CWE-94 (Code Injection): criteria strings stored in the database for concept reference ranges are evaluated as Apache Velocity templates without a sandbox.
Impact
- According to the record, a user holding the Manage Concepts privilege can store malicious template content that runs automatically when an observation is validated against the affected concept.
- The GitHub CNA scores the issue 9.1 under CVSS 3.1, with high confidentiality, integrity and availability impact and a scope change.
- The record states that the template context exposes patient, observation and service-layer objects.
Affected products and versions
- OpenMRS Core (openmrs-core) from 2.7.0 before 2.7.9.
- OpenMRS Core from 2.8.0 before 2.8.6.
- The description states the fix is in 2.7.9 and 2.8.6. The structured fixes field in the record is empty, so the official advisory should be checked for details.
Exploitation status
This CVE is not listed in the CISA KEV catalog according to the record. No confirmed exploitation appears in the sources consulted. The SSVC fields in the record report exploitation as none and automatable as no.
Remediation and mitigation
- Upgrade OpenMRS Core to 2.7.9 or 2.8.6, matching the release line in use.
- Until the upgrade is applied, limit the Manage Concepts privilege to trusted administrators and review who holds it.
- Audit concept reference range criteria for unexpected template syntax and treat unfamiliar values as suspicious.
Detection guidance
- Review recent changes to concept reference range definitions and identify the accounts that made them.
- Monitor application logs for template evaluation errors or unusual activity around observation validation.
- Compare stored criteria with known-good configuration backups.
Limitations of the available information
The record contains no NVD score, so the 9.1 value comes from the GitHub CNA. The NVD source status is listed as Deferred. Technical details beyond the description are in the GitHub advisory, which was not reviewed in full for this analysis. The EPSS probability is 0.0054 with a percentile of 0.43877.
Frequently asked questions
Which OpenMRS Core versions are affected by CVE-2026-41258?
The record lists OpenMRS Core from 2.7.0 before 2.7.9 and from 2.8.0 before 2.8.6 as affected.
Which versions fix this issue?
The description states that the vulnerability is fixed in 2.7.9 and 2.8.6. The structured fixes field in the record is empty.
Is this CVE known to be exploited in the wild?
No. The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted.
Who can trigger the vulnerable behavior?
According to the record, a user with the Manage Concepts privilege can store the malicious content, and it runs when an observation is validated against the affected concept.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.