{"id":"CVE-2026-126425","kind":"vulnerability","aliases":["CVE-2026-126425"],"related":[],"title":"OpenEMR: stored SQL injection through history layout fields lets users read data","description":"OpenEMR before 8.5.0 contains a stored SQL injection vulnerability in which History layout field identifiers saved through edit_layout.php, including HIS fields and LBF source-H fields, are placed unvalidated into an INSERT statement for patients without a history_data row. Users with admin/super and patients/med write access can trigger history_save.php or LBF saves to execute SQL functions like SLEEP, tying up database workers or accessing data beyond their privileges.","summary":"OpenEMR before 8.5.0 places unvalidated History layout field identifiers into an INSERT statement for patients without a history row. Users with admin or med write access can trigger SQL functions such as SLEEP, tying up database workers or reading data beyond their privileges.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","runtime","self-hosted","sql"],"not_affected_if":["no-write-access-users","openemr-8.5.0-or-later"],"how_to_check":"- Check the OpenEMR version in the installed application; versions before `8.5.0` are named as affected.\n- Review who holds admin, super or patients/med write access in OpenEMR.","fix":"- OpenEMR: move to `8.5.0` or later.","status":"open","published_at":"2026-11-13T10:17:48+00:00","first_seen_at":"2026-11-13T10:47:21+00:00","triaged_at":"2026-11-13T10:52:46+00:00","updated_at":"2026-11-13T10:52:46+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-13T10:52:46Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: move to `8.5.0` or later.","reach":"network","title":"OpenEMR: stored SQL injection through history layout fields lets users read data","impact":"medium","summary":"OpenEMR before 8.5.0 places unvalidated History layout field identifiers into an INSERT statement for patients without a history row. Users with admin or med write access can trigger SQL functions such as SLEEP, tying up database workers or reading data beyond their privileges.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["openemr","self-hosted","healthcare","sql"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"database workers stall or data beyond privileges is read","analyst_note":"","how_to_check":"- Check the OpenEMR version in the installed application; versions before `8.5.0` are named as affected.\n- Review who holds admin, super or patients/med write access in OpenEMR.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["openemr-8.5.0-or-later","no-write-access-users"],"who_is_affected":"OpenEMR installations before 8.5.0 are exposed, and the flaw needs a user with admin, super or patients/med write access to trigger it through history_save.php or LBF saves. Teams that run OpenEMR for clinics or hospitals should look at it; the sources do not say whether self-hosted and hosted deployments differ.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000742,"input_tokens":4651,"output_tokens":554,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126425':15A,18A '-2026':14A,17A '8.5.0':28B,71C 'access':51B,116C,134C 'admin':47B 'admin/super':112C 'beyond':66B,136C 'contain':72C 'cve':13A,16A 'data':12A,65B,108C,135C 'databas':61B,131C 'edit_layout.php':86C 'execut':124C 'field':8A,33B,82C,89C,95C 'function':55B,126C 'h':94C 'healthcar':19B 'histori':6A,31B,43B,80C,107C 'history_save.php':119C 'host':24B 'identifi':34B,83C 'includ':87C 'inject':4A,76C 'insert':37B,101C 'layout':7A,32B,81C 'lbf':91C,121C 'let':9A 'like':127C 'med':49B 'openemr':1A,20B,26B,69C 'patient':40B,104C 'patients/med':114C 'place':29B,97C 'privileg':68B,138C 'read':11A,64B 'row':44B,109C 'runtim':21B 'save':84C,122C 'self':23B 'self-host':22B 'sleep':58B,128C 'sourc':93C 'source-h':92C 'sql':3A,25B,54B,75C,125C 'statement':38B,102C 'store':2A,74C 'tie':59B,129C 'trigger':53B,118C 'unvalid':30B,98C 'user':10A,45B,110C 'vulner':77C 'without':41B,105C 'worker':62B,132C 'write':50B,115C","nicknames":[],"mitigations":[],"who_affected":"OpenEMR installations before 8.5.0 are exposed, and the flaw needs a user with admin, super or patients/med write access to trigger it through history_save.php or LBF saves. Teams that run OpenEMR for clinics or hospitals should look at it; the sources do not say whether self-hosted and hosted deployments differ.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","high","openemr","runtime","selfhosted","sql"],"campaign_type":null,"search_a":"'-126425':15A,18A '-2026':14A,17A 'cve':13A,16A 'data':12A 'field':8A 'histori':6A 'inject':4A 'layout':7A 'let':9A 'openemr':1A 'read':11A 'sql':3A 'store':2A 'user':10A","search_b":"'8.5.0':28B 'access':51B 'admin':47B 'beyond':66B 'data':65B 'databas':61B 'field':33B 'function':55B 'healthcar':19B 'histori':31B,43B 'host':24B 'identifi':34B 'insert':37B 'layout':32B 'med':49B 'openemr':20B,26B 'patient':40B 'place':29B 'privileg':68B 'read':64B 'row':44B 'runtim':21B 'self':23B 'self-host':22B 'sleep':58B 'sql':25B,54B 'statement':38B 'tie':59B 'trigger':53B 'unvalid':30B 'user':45B 'without':41B 'worker':62B 'write':50B","search_c":"'8.5.0':71C 'access':116C,134C 'admin/super':112C 'beyond':136C 'contain':72C 'data':108C,135C 'databas':131C 'edit_layout.php':86C 'execut':124C 'field':82C,89C,95C 'function':126C 'h':94C 'histori':80C,107C 'history_save.php':119C 'identifi':83C 'includ':87C 'inject':76C 'insert':101C 'layout':81C 'lbf':91C,121C 'like':127C 'openemr':69C 'patient':104C 'patients/med':114C 'place':97C 'privileg':138C 'row':109C 'save':84C,122C 'sleep':128C 'sourc':93C 'source-h':92C 'sql':75C,125C 'statement':102C 'store':74C 'tie':129C 'trigger':118C 'unvalid':98C 'user':110C 'vulner':77C 'without':105C 'worker':132C 'write':115C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T01:46:15+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126425","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126425","severity":null,"published_at":"2026-11-13T10:17:48+00:00","modified_at":"2026-11-13T10:17:48+00:00","first_seen_at":"2026-11-13T10:47:21+00:00","fetched_at":"2026-11-13T10:47:21+00:00","note":null}],"documents":[{"id":145093,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-fq58-jp5g-x44q","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-28T01:46:15+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145094,"url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-stored-sql-injection-via-history-layout-field-identifiers","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}