The vulnerability (CVE-2026-41258) in openmrs-core arises from improper control of code generation (CWE-94) in the evaluateCriteria() method of ConceptReferenceRangeUtility. The method evaluates criteria strings stored in the database as Apache Velocity templates without sandbox restrictions, using a VelocityEngine initialized with noSecureUberspector and default UberspectImpl. This configuration permits unrestricted Java reflection through template expressions. A user with Manage Concepts privilege can store malicious Velocity template expressions in a concept's reference range criteria field, which are executed automatically during observation validation. The Velocity context exposes sensitive objects ($patient, $obs, $fn) that provide access to patient data and the full OpenMRS service layer. The vulnerability is present in versions 2.7.0 to before 2.7.9 and 2.8.0 to before 2.8.6 and has been fixed in 2.7.9 and 2.8.6.

Successful exploitation allows a privileged user to execute arbitrary Java code within the OpenMRS server process, leading to complete compromise of confidentiality, integrity, and availability of the system. This includes unauthorized access to patient data and potential full control over the OpenMRS service layer. The CVSS score of 9.1 reflects the critical nature of this vulnerability with network attack vector, low attack complexity, required high privileges, no user interaction, and complete impact on confidentiality, integrity, and availability.

This vulnerability is fixed in OpenMRS Core versions 2.7.9 and 2.8.6. Users should upgrade to these or later versions to remediate the issue. No official patch or temporary fix is provided other than upgrading. Until upgraded, restrict Manage Concepts privilege to trusted users only to reduce risk. Patch status is not explicitly stated beyond the fixed versions; check the official OpenMRS advisories for the latest remediation guidance.