EIP-2026-119682

This exploit demonstrates an XML External Entity (XXE) vulnerability in OpenMRS 2.3 (Platform 1.11.4) by crafting a malicious XML file within a ZIP archive. It allows an authenticated attacker to read local files (e.g., /etc/passwd) by exploiting improper XML entity parsing in the Metadata Sharing module.