The vulnerability is a path traversal flaw in the ModuleResourcesServlet of OpenMRS Core, allowing an attacker to construct a file path that escapes the intended module resources directory. By sending a specially crafted request to the "/openmrs/moduleResources/{moduleid}" endpoint, an unauthenticated adversary can read any file on the server file system, including sensitive configuration files and "/etc/passwd". This weakness exists because the servlet concatenates user input without normalization or boundary checking, a classic example of CWE-22.

OpenMRS Core is affected, specifically vulnerability applies to versions 2.7.8 and earlier, and 2.8.0 through 2.8.5. The flaw was fixed in the 2.7.x series after 2.7.8 and in the 2.8.x series after 2.8.5.

The CVSS score of 8.2 reflects moderate to high risk. The exploit can be performed over an unauthenticated HTTP connection, provided the deployment uses Apache Tomcat versions prior to 8.5.31 or prior to 9.0.10, where a known Tomcat path‑parameter bypass exists. Deployments on Tomcat 8.5.31 and later or Tomcat 9.0.10 and later are protected at the container level, but the underlying code defect remains. The vulnerability is not listed in the CISA KEV catalog and no EPSS score is available, but the lack of authentication combined with simple path manipulation makes exploitation relatively straightforward under the conditions described.