CVE-2026-25928·PHP vulnerability

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at <0.1% — higher than 4% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Affected versions

How to fix this CVE

OpenEMR versions prior to 8.0.0.2 contain a path traversal vulnerability in the DICOM zip export feature that allows authenticated users to write files outside intended directories, potentially enabling remote code execution. Upgrade OpenEMR to version 8.0.0.2 or later immediately, and review file permissions on your web root to ensure proper access controls are in place. Verify that no unauthorized files were written outside the DICOM export directory by checking your filesystem logs and audit trails.

sudo dnf update php php-cli php-fpm php-common php-json php-mysqlnd php-zip php-gd php-mbstring php-curl php-xml php-opcache

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

POST|GET /openemr/.*export.*\.php.*zip.*path=(\.\./|%2e%2e%2f|..\\)

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch.

Block HTTP requests to DICOM export endpoints that contain path traversal sequences (../, ..\, %2e%2e%2f, %252e%252e%252f) in any parameter; implement strict input validation to reject non-alphanumeric characters in file path and destination parameters.

How to check if you are affected

1. Check the installed OpenEMR version by running: grep -r 'version' /var/www/openemr/version.php or checking the Administration > Version page in the web interface
2. Verify DICOM export functionality is enabled by checking if any DICOM-related modules or ZIP creation features are active in OpenEMR settings
3. Search web server logs for DICOM export requests with suspicious path sequences using: grep -E '\.\./' /var/log/apache2/access.log or /var/log/nginx/access.log
4. Confirm the patch was applied by verifying OpenEMR version is 8.0.0.2 or higher and checking the commit hash in the source code: grep -r 'ddcf04ea769a33cdc1932355224575478df70585' /var/www/openemr/

Indicators of compromise

• POST requests to DICOM export endpoints with ../ or similar sequences in the path parameter
• Unexpected PHP or executable files created outside /var/www/openemr/documents/ directory
• Suspicious file writes in web-accessible directories with timestamps correlating to DICOM export activity

FAQ

Related PHP CVEs

References

• https://github.com/openemr/openemr/commit/ddcf04ea769a33cdc1932355224575478df70585
• https://github.com/openemr/openemr/security/advisories/GHSA-rppw-f689-6hrm