CVE-2026-126417: OpenEMR before 8.5.0 Information Disclosure via get_claim_file.php
OpenEMR before 8.5.0 contains an access control flaw in getclaimfile.php: with location=tmp, it serves any file in the shared temporary directory without verifying the file is a claim for the caller. Users with acct/eob or acct/bill write access can request key=ccda.xml to download the most recently validated patient's complete C-CDA clinical document.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
Authenticated users with acct/eob or acct/bill write access can exploit it. The issue does not require the user to be associated with the patient whose document is retrieved.
What information could be exposed?
An affected user can request key=ccda.xml with location=tmp to download the most recently validated patient's complete C-CDA clinical document from the shared temporary directory.
Are installations affected by default?
The affected endpoint serves files from the shared temporary directory when location=tmp is used, but exploitation requires an account with acct/eob or acct/bill write access.
How can I determine whether a system is vulnerable?
OpenEMR versions before 8.5.0 are affected. Review whether users holding acct/eob or acct/bill write permissions can access get_claim_file.php and retrieve ccda.xml using location=tmp.