What is the CVSS score of EUVD-2026-13162?

EUVD-2026-13162 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Openemr are affected by EUVD-2026-13162?

OpenEMR contains a remote code execution vulnerability (CVE-2026-33301, CVSS 8.1) that allows unauthenticated attackers to execute arbitrary code on healthcare systems.. A patch is available.

How to fix or mitigate EUVD-2026-13162?

Within 24 hours: inventory all OpenEMR deployments and current versions across the enterprise. Within 7 days: apply vendor-released patch to all OpenEMR instances and validate successful deployment through version verification. Within 30 days: conduct post-patch validation testing in production environments and document remediation completion for compliance records.

Openemr EUVD-2026-13162

| CVE-2026-33301 HIGH

Improper Encoding or Escaping of Output (CWE-116)

2026-03-19 GitHub_M

Information Disclosure Openemr

8.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:20 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

8.0.0.2

EUVD ID Assigned

Mar 19, 2026 - 21:00 euvd

EUVD-2026-13162

Analysis Generated

Mar 19, 2026 - 21:00 vuln.today

CVE Published

Mar 19, 2026 - 20:10 nvd

HIGH 8.1

DescriptionGitHub Advisory

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, users with the Notes - my encounters role can fill Eye Exam forms in patient encounters. The answers to the form can be printed out in PDF form. An arbitrary file read vulnerability was identified in the PDF creation function where the form answers are parsed as unescaped HTML, allowing an attacker to include arbitrary image files from the server in the generated PDF. Version 8.0.0.2 fixes the issue.

AnalysisAI

A remote code execution vulnerability in OpenEMR (CVSS 8.1). High severity vulnerability requiring prompt remediation.

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Authenticate with Notes role

Delivery

Fill Eye Exam form with malicious HTML

Exploit

Request PDF generation

Execution

Parse unescaped HTML in PDF

Impact

Read arbitrary server files