OpenEMR encrypts DICOM folders into a zip file by directly using a user‑supplied path component without sanitization. The directory traversal sequences (e.g., "../") allow an attacker to place files outside the intended export directory. An attacker who can upload or export DICOM data can therefore write files to arbitrary locations, including the web root. If the written files contain executable code such as PHP scripts, this can lead to remote code execution. The weakness is a classic path‑traversal issue, classified as CWE‑22.

The flaw exists in the openemr openemr electronic health records product before version 8.0.0.2. Users running any release of OpenEMR older than 8.0.0.2 that includes the DICOM zip/export feature are vulnerable. The affected functionality is the DICOM folder export that creates zip archives.

The CVSS score is 6.5, indicating moderate severity, and the EPSS score is below 1%, suggesting a low probability of public exploitation so far. The vulnerability is not listed in the CISA KEV catalog, but it can be leveraged by users with DICOM upload/export permissions, which may be a common role in clinical settings. An attacker would craft a DICOM file whose filename contains traversal sequences, upload it, then trigger an export to force the application to write the file outside the intended directory. No known public exploits are disclosed yet, but the attack path is straightforward if the necessary permissions are available. The official fix is to upgrade to OpenEMR 8.0.0.2 or later, where the path component is properly sanitized.