Openemr
CVE-2026-33913
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to OpenEMR
-
DeliveryAccess Carecoordination module
-
ExploitUpload crafted CCDA with XI include directive
-
ExecutionParse file path reference
-
ImpactRead arbitrary server files
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A02:2025 - Security Misconfiguration
ASVS 5.0
V13 - Configuration XML external entity prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Authenticated user with access to OpenEMR Carecoordination module (versions before 8.0.0.3) must upload a crafted CCDA document containing XML External Entity (XXE) payload to read arbitrary files from the server. No victim interaction required beyond the attacker's authenticated upload action. |
| Impact | The real-world risk is significant due to the combination of factors: the vulnerability requires only low-privilege authenticated access (PR:L) with no user interaction (UI:N) and low attack complexity (AC:L), making it easily exploitable by any authenticated user with Carecoordination module access. The scope change (S:C) and high confidentiality impact (C:H) indicate potential for accessing sensitive healthcare data beyond the vulnerable component's privileges. While no EPSS score or KEV status is provided in the intelligence, the availability of a public GitHub security advisory and commit patch (67e1702c41cf486af0069bdafce19860e2cd9a11) significantly increases exploit likelihood as attackers can reverse-engineer the fix. Given OpenEMR's use in healthcare environments containing protected health information (PHI), the impact of arbitrary file read access could lead to HIPAA violations and data breaches. This should be treated as a high-priority remediation item for any organization running affected OpenEMR versions, especially considering the technical simplicity of XXE exploitation and the sensitive nature of medical records systems. |
| Exploit ScenarioDerived | An authenticated healthcare staff member with low-level access to OpenEMR's Carecoordination module creates a malicious CCDA XML document containing an XInclude directive pointing to sensitive server files like /etc/passwd, application configuration files containing database credentials, or other patient data files. The attacker uploads this crafted document through the normal CCDA import functionality, and the vulnerable XML parser processes the external entity reference, returning the contents of the targeted file within the application response or error messages. With network-based access (AV:N) and low complexity (AC:L), this attack can be executed remotely by any authenticated user without special tools or conditions, potentially exposing protected health information and system credentials. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 25, 2026
OpenEMR versions prior to 8.0.0.3 contain an XML External Entity (XXE) injection vulnerability in the Carecoordination module that allows authenticated users to read arbitrary files from the server. Attackers can exploit this by uploading a maliciously crafted CCDA document containing XXE payloads to access sensitive server files such as /etc/passwd. A patch is available in version 8.0.0.3, and this vulnerability has a CVSS score of 7.7 with high confidentiality impact.
RemediationAI
Upgrade OpenEMR to version 8.0.0.3 or later, which contains the security patch addressing the XXE vulnerability (release information available at https://github.com/openemr/openemr/releases/tag/v8_0_0_3). The specific fix is implemented in commit 67e1702c41cf486af0069bdafce19860e2cd9a11 (https://github.com/openemr/openemr/commit/67e1702c41cf486af0069bdafce19860e2cd9a11), which properly disables external entity processing in the XML parser. As a temporary workaround until patching is possible, organizations should restrict access to the Carecoordination module to only essential users, implement strict input validation and file upload monitoring, and deploy web application firewall rules to detect XXE attack patterns in CCDA document uploads. Review server logs for suspicious CCDA uploads and audit which users have accessed the Carecoordination module to identify potential exploitation attempts.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability affects OpenEMR (cpe:2.3:a:openemr:openemr:*:*:*:*:*:*:*:*), an open-source electronic health records and medical practice management system. The root cause is CWE-611 (Improper Restriction of XML External Entity Reference), which occurs when an XML parser is configured to process external entities without proper sanitization. The Carecoordination module's CCDA (Consolidated Clinical Document Architecture) document upload functionality fails to disable external entity processing, allowing attackers to leverage XML Include (XInclude) directives like '<xi:include href="file:///etc/passwd" parse="text"/>' to read arbitrary files from the server filesystem. This classic XXE vulnerability enables local file disclosure through XML parser exploitation.
Know when Openemr gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
DescriptionGitHub Advisory
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, an authenticated user with access to the Carecoordination module can upload a crafted CCDA document containing <xi:include href="file:///etc/passwd" parse="text"/> to read arbitrary files from the server. Version 8.0.0.3 patches the issue.
Executive ViewAI
OpenEMR installations are vulnerable to unauthorized file access through a flaw in the Carecoordination module that allows authenticated users to extract sensitive server data. Organizations using affected versions risk exposure of confidential patient information and system credentials, potentially triggering regulatory compliance violations and reputational damage.
Disable the Carecoordination module if not operationally critical; implement Web Application Firewall (WAF) rules to block XML payloads in document uploads; restrict CCDA upload functionality to defined user roles with administrative approval; segment the OpenEMR server on a restricted network with limited outbound access; enforce strict input validation on document uploads; monitor and alert on suspicious file access patterns from the OpenEMR process.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
XML External Entity (XXE) attacks exploit XML parsers that process Document Type Definitions (DTDs) without proper restrictions.
Affected Products (CPE)GitHub Advisory
An authenticated SQL injection vulnerability exists in OpenEMR ≤ 4.1.1 Patch 14 that allows a low-privileged attacker to
Unauthenticated token disclosure in OpenEMR before 8.0.0. CVSS 10.0. PoC and patch available.
Path traversal in OpenEMR 7.0.4 disposeDocument() allows file access. PoC available.
Path traversal in OpenEMR electronic health records before fix allows authenticated users to read arbitrary files on the
SQL injection in OpenEMR electronic health records before fix. Authenticated users can execute arbitrary SQL through the
OpenEMR 7.0.2 is vulnerable to SQL Injection via \openemr\library\classes\Pharmacy.class.php, \controllers\C_Pharmacy.cl
An issue in OpenEMR 7.0.2 allows a remote attacker to escalate privileges viaa crafted POST request using the noteid par
Information disclosure in OpenEMR 5.0.2 to before 8.0.0 exposes sensitive data. PoC and patch available.
Remote code execution in OpenEMR through 8.2.0 lets an authenticated administrator poison the document category tree so
interface/fax/fax_dispatch.php in OpenEMR 4.1.0 allows remote authenticated users to execute arbitrary commands via shel
interface/globals.php in OpenEMR 2.x, 3.x, and 4.x before 4.2.0 patch 2 allows remote attackers to bypass authentication
Authentication bypass vulnerability in portal/account/register.php in versions of OpenEMR before 5.0.1.4 allows a remote
Exploit-DB