{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "range": [
                  {
                    "introduced": "= 0.93"
                  },
                  {
                    "last_affected": "= 0.93"
                  }
                ],
                "source": "AFFECTED_FIELD",
                "strategy": "StandaloneSingleVersion"
              },
              {
                "range": [
                  {
                    "introduced": "0"
                  },
                  {
                    "fixed": "0.93.1"
                  }
                ],
                "source": "DESCRIPTION"
              }
            ]
          },
          "events": [
            {
              "introduced": "74a33668784ead3e41ce20c0146f21375ddb9ad2"
            },
            {
              "fixed": "74a33668784ead3e41ce20c0146f21375ddb9ad2"
            }
          ],
          "repo": "https://github.com/bahmni/bahmni-core",
          "type": "GIT"
        }
      ],
      "versions": [
        "= 0.93"
      ]
    }
  ],
  "aliases": [
    "GHSA-pmw7-2mfv-4592"
  ],
  "database_specific": {
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
      "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63194.json"
  },
  "details": "OpenMRS module bahmnicore contains Core OpenMRS modules for Bahmni (including ERP \u0026 ELIS Atom Feed Clients). In version 0.93, there is insufficient validation of input paths during the admin CSV import process, allowing for potential arbitrary file write. This issue has been patched in version 0.93.1.",
  "id": "CVE-2026-63194",
  "modified": "2026-11-12T02:30:27.168082540Z",
  "published": "2026-11-11T02:34:24.288Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/Bahmni/bahmni-core/security/advisories/GHSA-pmw7-2mfv-4592"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63194.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63194"
    }
  ],
  "schema_version": "1.9.2",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Bahmni-Core: Path traversal may lead to arbitrary file write in the admin CSV import"
}