CVE-2026-124457: OpenEMR before 8.3.0 Path Traversal via sl_eob_process.php eraname

Published Nov 8, 2026

Updated

OpenEMR before 8.3.0 contains a path traversal vulnerability in interface/billing/sleobprocess.php that allows authenticated users to write and read files by supplying unsanitized eraname values. Attackers without billing privileges can inject ../ sequences to create ERA report .html files anywhere the web user can write and parse arbitrary .edi files echoed into the report.

Event History

Nov 8, 2026

CVE Published

via MITRE·01:15 PM

Data Sourced

via MITRE·01:15 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

OpenEMR versions before 8.3.0 are affected. The vulnerable functionality is in interface/billing/sl_eob_process.php.

What access does an attacker need?

An attacker needs an authenticated OpenEMR account with low privileges. Billing privileges are not required.

What can exploitation allow?

An attacker can use ../ sequences in the eraname value to write ERA report .html files in locations writable by the web user and read files through the vulnerable processing. They can also supply arbitrary .edi content that is echoed into the generated report.

CVE-2026-124457: OpenEMR before 8.3.0 Path Traversal via sl_eob_process.php eraname

Event History

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need?

What can exploitation allow?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need?

What can exploitation allow?