CVE-2026-126481: OpenEMR before 8.5.0 Path Traversal via ERA 835 File Upload
OpenEMR before 8.5.0 contains a path traversal vulnerability in erapayments.php and sleobsearch.php that allows authenticated billing users to write files outside the ERA directory. Attackers can embed traversal sequences in the GS04 element of an uploaded X12 835 file to overwrite .edi or .835 files with attacker-controlled content anywhere writable by the web server.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated OpenEMR account with billing-user access and the ability to upload an X12 835 ERA file. The issue is remotely reachable and does not require user interaction.
What files can be overwritten?
The attacker can use traversal sequences in the GS04 element of the uploaded X12 835 file to target .edi or .835 files outside the ERA directory, provided the destination location is writable by the web server.
Which installations are affected?
OpenEMR versions before 8.5.0 are affected. The provided information does not identify any configuration change that disables the vulnerable upload handling.
How can I assess whether an attempted exploit occurred?
Review ERA upload activity and uploaded X12 835 files for traversal sequences in their GS04 elements. Also investigate unexpected modifications to .edi and .835 files in locations writable by the web server outside the intended ERA directory.