OpenMRS Core 2.7.8 and earlier, and 2.8.0 through 2.8.5, allow an authenticated attacker to exploit a Zip Slip path traversal condition when uploading .omod modules. The extraction routine concatenates the ZIP entry path directly into the destination without normalization, enabling crafted entries such as "web/module/../../../../malicious.jsp" to write files outside the intended module directory. An attacker who can upload a module can thus place arbitrary files in the web application root and trigger remote code execution by uploading a JSP and accessing it. The flaw also bypasses the module.allow_web_admin property for the REST API, meaning configurations that disable web‑based module administration do not protect this endpoint.

Affected vendor is OpenMRS Core with product name OpenMRS Core; versions 2.7.8 and earlier, and 2.8.0 to 2.8.5 are vulnerable. Fixes are available in all subsequent versions, including 2.8.6 and later.

The CVSS score of 9.4 indicates a high severity vulnerability, and while an EPSS score is not provided, the lack of CISA KEV listing does not diminish the risk. The attack vector is inferred to be remote, requiring access to the REST API endpoint POST "/openmrs/ws/rest/v1/module" and valid authentication with module upload privileges. The vulnerability is trivial to exploit once the prerequisites are met, as the exploit merely requires uploading a crafted archive. Compounding factors include the ignored module.allow_web_admin setting, meaning deployments that rely on that property for security remain exposed.