CVE-2026-41258
1 advisory.
Maven/org.openmrs.api:openmrs-api CVE-2026-41258: critical 9.1
OpenMRS has Stored Velocity SSTI to RCE via ConceptReferenceRange
Action: Upgrade org.openmrs.api:openmrs-api to 2.7.9 (2.7.x) or 2.8.6 (2.8.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.7.0 | 2.7.9 | - |
| 2.8.0 | 2.8.6 | - |
Fixed versions
| 2.7.9 | 2.8.6 |
Sources
- osv: GHSA-xj4f-8jjg-vx4q
- https://github.com/openmrs/openmrs-core/security/advisories/GHSA-xj4f-8jjg-vx4q
- https://nvd.nist.gov/vuln/detail/CVE-2026-41258
- https://github.com/openmrs/openmrs-core/commit/8d1c193
- https://github.com/openmrs/openmrs-core
- https://www.machinespirits.com/advisory/1e8430
CVE-2026-41258 · published · modified · JSON