OPENEMR · CVE-2026-126428 · Package
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.5.0 lets an authenticated billing user upload a malformed ERA file that stores attacker-controlled PHP on the server. An attacker with a database write primitive can register a background service that loads that file, running PHP as the web-server user.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any site running OpenEMR before 8.5.0 where billing users can upload ERA files. The path needs an authenticated billing account, and the second stage needs a database write flaw such as SQL injection. Installations on 8.5.0 or later are not affected.
Not affected if no-billing-users, openemr-8.5.0-or-later
Who cares healthcare, openemr, php, self-hosted
era_payments.php and stored .edi files under the web root or upload pathsbackground_services table for unexpected rows with require_once entries8.5.0 or laterOpenEMR before 8.5.0 contains a remote code execution vulnerability that allows authenticated billing users to store attacker-controlled PHP by uploading a malformed ERA file to era_payments.php. Attackers with a database-write primitive such as SQL injection can register a background_services row whose require_once loads the stored .edi file, executing PHP as the web-server user.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.