The vulnerability in OpenMRS Core is a stored Velocity SSTI flaw (CWE-94) that allows an attacker with the Manage Concepts privilege to store a malicious Velocity template expression in a concept’s reference range criteria field. Based on the description, it is inferred that the attacker must have Manage Concepts privilege to exploit the vulnerability. When the application later validates an observation against that concept, the stored template is rendered with unrestricted access to Java reflection. This creates a stored Velocity template injection that can be leveraged for remote code execution on the server.

OpenMRS Core versions from 2.7.0 through 2.7.8 and all 2.8.x releases prior to 2.8.6 are vulnerable. The fix was applied in 2.7.9 and 2.8.6.

The CVSS score of 9.1 marks this flaw as critical. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, but the lack of sandboxing combined with full Java reflection gives the attacker a powerful attack vector whenever an observation validation occurs. Based on the description, it is inferred that the attacker must control a concept; once they do, they can download or modify code, read sensitive data, and elevate privileges. The attack is essentially local to users with Manage Concepts rights but leads to system compromise. Given the severity and the expansive impact, prompt remediation is essential.