What is the CVSS score of CVE-2026-33913?

CVE-2026-33913 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Openemr are affected by CVE-2026-33913?

OpenEMR installations are vulnerable to unauthorized file access through a flaw in the Carecoordination module that allows authenticated users to extract sensitive server data.

How to fix or mitigate CVE-2026-33913?

Within 24 hours: Identify all OpenEMR instances and document current versions; restrict access to the Carecoordination module to essential personnel only. Within 7 days: Implement network segmentation to limit OpenEMR server exposure; enable logging and monitoring for CCDA document uploads. Within 30 days: Upgrade all systems to OpenEMR 8.0.0.3 or later; conduct a security audit to identify any unauthorized file access attempts in logs.

Openemr CVE-2026-33913

HIGH

Improper Restriction of XML External Entity Reference (CWE-611)

2026-03-25 GitHub_M

XXE Openemr

7.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 25, 2026 - 23:02 vuln.today

CVE Published

Mar 25, 2026 - 22:52 nvd

HIGH 7.7

DescriptionGitHub Advisory

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, an authenticated user with access to the Carecoordination module can upload a crafted CCDA document containing <xi:include href="file:///etc/passwd" parse="text"/> to read arbitrary files from the server. Version 8.0.0.3 patches the issue.

AnalysisAI

OpenEMR versions prior to 8.0.0.3 contain an XML External Entity (XXE) injection vulnerability in the Carecoordination module that allows authenticated users to read arbitrary files from the server. Attackers can exploit this by uploading a maliciously crafted CCDA document containing XXE payloads to access sensitive server files such as /etc/passwd. A patch is available in version 8.0.0.3, and this vulnerability has a CVSS score of 7.7 with high confidentiality impact.

Technical ContextAI

This vulnerability affects OpenEMR (cpe:2.3:a:openemr:openemr:*:*:*:*:*:*:*:*), an open-source electronic health records and medical practice management system. The root cause is CWE-611 (Improper Restriction of XML External Entity Reference), which occurs when an XML parser is configured to process external entities without proper sanitization. The Carecoordination module's CCDA (Consolidated Clinical Document Architecture) document upload functionality fails to disable external entity processing, allowing attackers to leverage XML Include (XInclude) directives like '<xi:include href="file:///etc/passwd" parse="text"/>' to read arbitrary files from the server filesystem. This classic XXE vulnerability enables local file disclosure through XML parser exploitation.

RemediationAI

Upgrade OpenEMR to version 8.0.0.3 or later, which contains the security patch addressing the XXE vulnerability (release information available at https://github.com/openemr/openemr/releases/tag/v8_0_0_3). The specific fix is implemented in commit 67e1702c41cf486af0069bdafce19860e2cd9a11 (https://github.com/openemr/openemr/commit/67e1702c41cf486af0069bdafce19860e2cd9a11), which properly disables external entity processing in the XML parser. As a temporary workaround until patching is possible, organizations should restrict access to the Carecoordination module to only essential users, implement strict input validation and file upload monitoring, and deploy web application firewall rules to detect XXE attack patterns in CCDA document uploads. Review server logs for suspicious CCDA uploads and audit which users have accessed the Carecoordination module to identify potential exploitation attempts.