Path Traversal Vulnerability in OpenEMR by OpenEMR

CVE-2026-124457

What is CVE-2026-124457?

OpenEMR versions prior to 8.3.0 are susceptible to a path traversal vulnerability located in the file interface/billing/sl_eob_process.php. This flaw permits authenticated users to manipulate file paths by submitting improperly sanitized eraname values. Attackers lacking billing privileges can exploit this weakness to inject '../' directory traversal sequences. As a result, they can create ERA report .html files in any directory where the web user has write permissions, and potentially parse arbitrary .edi files, which can lead to critical security breaches.

References