OpenEMR versions older than 8.3.0 contain a path traversal flaw in the EDI archive restore function. The archrestore_sel POST parameter is accepted without sanitizing directory traversal sequences. When the supplied path is checked against the file system, the differing success or failure messages reveal whether the target file exists. An authenticated user who has EOB Data Entry permissions can therefore probe arbitrary filesystem paths on the server, revealing the presence of files and potentially confidential directory structures. The attack is limited to information disclosure; there is no opportunity for code execution or privilege escalation.

The vendor is OpenEMR, and the product is the OpenEMR electronic medical record system. All releases prior to 8.3.0 are affected, as the fix was introduced in the 8.3.0 release.

The CVSS score of 5.3 indicates a moderate severity for this kind of information disclosure. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation is possible only by an authenticated user with EOB Data Entry permissions, so the risk is confined to individuals who hold that role. Nonetheless, the ability to locate arbitrary files can aid attackers in constructing further attacks against sensitive data stored on the system.