Vulnerability Description
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, an authenticated user with access to the Carecoordination module can upload a crafted CCDA document containing `<xi:include href="file:///etc/passwd" parse="text"/>` to read arbitrary files from the server. Version 8.0.0.3 patches the issue.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Open-Emr | Openemr | < 8.0.0.3 |
Related Weaknesses (CWE)
References
- https://github.com/openemr/openemr/commit/67e1702c41cf486af0069bdafce19860e2cd9aPatch
- https://github.com/openemr/openemr/releases/tag/v8_0_0_3Product
- https://github.com/openemr/openemr/security/advisories/GHSA-9757-3cfj-wc8qExploitMitigationVendor Advisory
FAQ
What is CVE-2026-33913?
CVE-2026-33913 is a vulnerability with a CVSS score of 7.7 (HIGH). OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, an authenticated user with access to the Carecoordination module can ...
How severe is CVE-2026-33913?
CVE-2026-33913 has been rated HIGH with a CVSS base score of 7.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-33913?
Check the references section above for vendor advisories and patch information. Affected products include: Open-Emr Openemr.