CVE-2018-1000647

7.1 highEPSS 1.5%

High (7.1) in librehealth librehealth ehr. EPSS 1.5% chance of exploitation in the next 30 days.

LibreHealthIO lh-ehr version REL-2.0.0 contains a Authenticated Unrestricted File Deletion vulnerability in Import template that can result in Denial of service. This attack appear to be exploitable via User controlled parameter.

Severity

CVSS 3.0

7.1 high

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

EPSS: 1.5% chance of exploitation in the next 30 days; higher than 73% of CVEs (scores of 2026-10-31)
CWEs: CWE-20, CWE-22
Published: 2018-08-20
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

librehealth:librehealth_ehr

References

https://0dd.zone/2018/08/07/lh-ehr-Authenticated-File-Deletion/
https://github.com/LibreHealthIO/lh-ehr/issues/1212
https://0dd.zone/2018/08/07/lh-ehr-Authenticated-File-Deletion/
https://github.com/LibreHealthIO/lh-ehr/issues/1212

Check your stack JSON