File Inclusion Vulnerability in OpenEMR by OpenEMR
CVE-2026-33913

7.7HIGH

Key Information:

Vendor

Openemr

Status
Openemr
Vendor
CVE Published:
25 March 2026

What is CVE-2026-33913?

OpenEMR, a widely-used open-source electronic health records and medical practice management application, has a vulnerability that allows an authenticated user with access to the Carecoordination module to upload a specially crafted CCDA document. This document can execute commands that lead to the exposure of sensitive files on the server, specifically using the <xi:include> directive to read arbitrary files like the /etc/passwd. This security flaw is addressed and patched in version 8.0.0.3.

Affected Version(s)

openemr < 8.0.0.3

References

https://github.com/openemr/openemr/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/openemr/openemr/commit/67e1702c41cf486...
x_refsource_MISC
https://github.com/openemr/openemr/releases/tag/v8_0_0_3
x_refsource_MISC

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.