CVE-2018-1000839

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-12-20 · updated 2026-06-17
Weakness: CWE-434

Description

LH-EHR version REL-2_0_0 contains a Arbitrary File Upload vulnerability in Profile picture upload that can result in Remote Code Execution. This attack appear to be exploitable via Uploading a PHP file with image MIME type.

Affected products

Librehealth Ehr: 2.0.0

References

https://0dd.zone/2018/09/03/lh-ehr-RCE-via-picture-upload/
https://github.com/LibreHealthIO/lh-ehr/issues/1223
https://0dd.zone/2018/09/03/lh-ehr-RCE-via-picture-upload/
https://github.com/LibreHealthIO/lh-ehr/issues/1223

Get alerted when CVE-2018-1000839 or the next vulnerability affects your stack