Out-of-Band Server-Side Request Forgery in OpenEMR by OpenEMR

CVE-2026-33321

What is CVE-2026-33321?

OpenEMR, a free and open-source electronic health records application, is susceptible to an Out-of-Band Server-Side Request Forgery (SSRF) vulnerability. This issue arises from the PDF creation function that improperly handles user input when generating Eye Exam forms. Specifically, the answers logged in the form are rendered as unescaped HTML, enabling an attacker to exploit the system by sending forged requests to both internal and external resources. This vulnerability was addressed in version 8.0.0.2, which mitigates the risks associated with this flaw.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References