CVE-2020-23829

HIGH

LibreHealth EHR <2.0.0 - Authenticated RCE

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2020-23829. PoCs published by boku.

AI-analyzed exploit summary This exploit demonstrates an authenticated file upload vulnerability in LibreHealth 2.0.0, allowing remote code execution by uploading a maliciously crafted PHP file disguised as an image. The PoC includes a webshell for post-exploitation command execution.

Description

interface/new/new_comprehensive_save.php in LibreHealth EHR 2.0.0 suffers from an authenticated file upload vulnerability, allowing remote attackers to achieve remote code execution (RCE) on the hosting webserver by uploading a maliciously crafted image.

Exploits (1)

exploitdb WORKING POC
by boku · textwebappsphp
https://www.exploit-db.com/exploits/48702

This exploit demonstrates an authenticated file upload vulnerability in LibreHealth 2.0.0, allowing remote code execution by uploading a maliciously crafted PHP file disguised as an image. The PoC includes a webshell for post-exploitation command execution.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: LibreHealth 2.0.0
Auth required
Prerequisites: Valid credentials for LibreHealth · Network access to the target server
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2
Core References
Exploit, Third Party Advisory x_refsource_misc
https://www.exploit-db.com/exploits/48702

Scores

CVSS v3 8.8
EPSS 0.0254
EPSS Percentile 82.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-434
Status published
Products (1)
librehealth/librehealth_ehr 2.0.0
Published Sep 01, 2020
Tracked Since Feb 18, 2026