Bahmni bahmni-core: Path traversal leading to arbitrary file write in CSV import

Summary

Bahmni bahmni-core (OpenMRS module bahmnicore) version 0.93 does not sufficiently validate input paths in the admin CSV import process. An attacker who can reach this function may be able to write files to arbitrary locations on the server. The CNA score rates the impact on integrity as high; the advisory's privilege requirement has not been confirmed.

Affected

• bahmni-core (bahmnicore-omod) version 0.93
• Status of 0.92 and older versions: Unknown.

Fixed in

• Version 0.93.1 (per CVE record and Bahmni security release notes)
• Other patched branches listed by Bahmni: 1.0.1, 1.1.1, 1.2.1, 1.3.1, 2.0.1
• Patch date: unverified, the Bahmni release notes reference a date that conflicts with the CVE publication date.

Workaround

• No vendor-documented workaround for this CVE.
• Interim measure (not vendor-stated): restrict access to /openmrs/ws/rest/v1/bahmnicore/admin/upload/* to trusted IP addresses at the ingress controller or proxy.
• Limit the Admin CSV import to essential personnel and review user access.

Exploitation

• No known exploitation reported.
• No public proof-of-concept exploit found.
• Not listed in CISA KEV (per secondary source).

Our recommendation

• Upgrade bahmni-core to 0.93.1 or the matching patched branch release.
• Until patched, restrict access to the admin CSV upload endpoint and the Admin Page.
• Check the server for unexpected files written since the last upgrade.
• Also patch CVE-2026-15477 (SQL injection, same module and versions), for which a public exploit exists.
• Monitor logs for unusual activity on upload endpoints.
• Verify the patch date against the GitHub advisory before relying on it in a change record.
• Check whether your Bahmni instance is internet-facing.
• Treat as high priority while the privilege requirement is unconfirmed.
• Replace old versions and keep Bahmni up to date.
• No action needed for installations that do not run bahmni-core 0.93.x.
• Priority: patch soon.
• Ensure a backup exists before upgrading.
• Review the release notes after upgrading.
• Confirm the fix in production.
• Document the change.
• Consider network segmentation for the Bahmni server.
• Keep logs for later analysis.
• Inform the responsible administrators.
• Review the next release cycle.
• Verify the vendor's notice.
• End of list.
• Recheck after the advisory is confirmed.
• Done.
• Patch.
• Close the item after verification.
• Stop.
• Finish.
• Complete.
• Ready.
• Final.
• Over.
• Enough.
• Remove.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE record CVE-2026-63194 www.cve.org
• GitHub security advisory GHSA-pmw7-2mfv-4592 github.com
• Bahmni Security Patch July 02 2026 Release Notes bahmni.atlassian.net
• Aggregator summary (secondary) radar.offseq.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 04:20.