CVE-2026-126428: OpenEMR before 8.5.0 RCE via Stored ERA Upload and Background Services
OpenEMR before 8.5.0 contains a remote code execution vulnerability that allows authenticated billing users to store attacker-controlled PHP by uploading a malformed ERA file to erapayments.php. Attackers with a database-write primitive such as SQL injection can register a backgroundservices row whose requireonce loads the stored .edi file, executing PHP as the web-server user.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with billing privileges can upload a malformed ERA file containing attacker-controlled PHP. To reach code execution, the attacker also needs a database-write primitive, such as SQL injection, to create or modify a background_services row.
Does uploading the malicious ERA file alone execute code?
No. The uploaded .edi file is executed only after a background service is registered so that its require_once loads that stored file.
What privileges does successful code execution have?
The attacker-controlled PHP executes as the web-server user.
Which versions are affected?
OpenEMR versions before 8.5.0 are affected.