CVE-2020-24621: Openmrs Htmlformentry

High severity, CVSS 8.8. EPSS: 3.2% chance of exploitation in the next 30 days.

A remote code execution (RCE) vulnerability was discovered in the htmlformentry (aka HTML Form Entry) module before 3.11.0 for OpenMRS. By leveraging path traversal, a malicious Velocity Template Language file could be written to a directory. This file could then be accessed and executed.

Affected products

• Openmrs Htmlformentry: before 3.11.0 (fixed in 3.11.0)

Published 2020-09-25. Last modified 2026-06-17.