{"id":"CVE-2026-126428","kind":"vulnerability","aliases":["CVE-2026-126428"],"related":[],"title":"OpenEMR: billing ERA upload lets authenticated users run PHP code","description":"OpenEMR before 8.5.0 contains a remote code execution vulnerability that allows authenticated billing users to store attacker-controlled PHP by uploading a malformed ERA file to era_payments.php. Attackers with a database-write primitive such as SQL injection can register a background_services row whose require_once loads the stored .edi file, executing PHP as the web-server user.","summary":"OpenEMR before 8.5.0 lets an authenticated billing user upload a malformed ERA file that stores attacker-controlled PHP on the server. An attacker with a database write primitive can register a background service that loads that file, running PHP as the web-server user.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"OpenEMR","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["healthcare","openemr","package","php","self-hosted"],"not_affected_if":["no-billing-users","openemr-8.5.0-or-later"],"how_to_check":"- Check the OpenEMR version in the installation (unknown exact command in sources)\n- Look for `era_payments.php` and stored `.edi` files under the web root or upload paths\n- Review the `background_services` table for unexpected rows with `require_once` entries","fix":"- OpenEMR: move to `8.5.0` or later","status":"open","published_at":"2026-11-13T10:17:49+00:00","first_seen_at":"2026-11-13T10:47:21+00:00","triaged_at":"2026-11-13T10:52:28+00:00","updated_at":"2026-11-13T10:52:28+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T10:52:28Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: move to `8.5.0` or later","reach":"internet","title":"OpenEMR: billing ERA upload lets authenticated users run PHP code","impact":"high","summary":"OpenEMR before 8.5.0 lets an authenticated billing user upload a malformed ERA file that stores attacker-controlled PHP on the server. An attacker with a database write primitive can register a background service that loads that file, running PHP as the web-server user.","audience":"businesses","category":"package","nicknames":[],"who_cares":["openemr","healthcare","php","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker runs PHP code as the web-server user on the server.","analyst_note":"Confirm exact affected versions and a check command from the vendor advisory at github.com and the VulnCheck advisory.","how_to_check":"- Check the OpenEMR version in the installation (unknown exact command in sources)\n- Look for `era_payments.php` and stored `.edi` files under the web root or upload paths\n- Review the `background_services` table for unexpected rows with `require_once` entries","plain_action":"","product_name":"OpenEMR","needs_analyst":true,"not_affected_if":["openemr-8.5.0-or-later","no-billing-users"],"who_is_affected":"Any site running OpenEMR before 8.5.0 where billing users can upload ERA files. The path needs an authenticated billing account, and the second stage needs a database write flaw such as SQL injection. Installations on 8.5.0 or later are not affected.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00076,"input_tokens":4616,"output_tokens":597,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126428':13A,16A '-2026':12A,15A '8.5.0':27B,73C 'allow':81C 'attack':41B,48B,88C,99C 'attacker-control':40B,87C 'authent':6A,30B,82C 'background':57B,113C 'bill':2A,31B,83C 'code':10A,77C 'contain':74C 'control':42B,89C 'cve':11A,14A 'databas':51B,103C 'database-writ':102C 'edi':122C 'era':3A,36B,95C 'era_payments.php':98C 'execut':78C,124C 'file':37B,62B,96C,123C 'healthcar':18B 'host':24B 'inject':109C 'let':5A,28B 'load':60B,119C 'malform':35B,94C 'openemr':1A,17A,19B,25B,71C 'packag':20B 'php':9A,21B,43B,64B,90C,125C 'primit':53B,105C 'regist':55B,111C 'remot':76C 'requir':117C 'row':115C 'run':8A,63B 'self':23B 'self-host':22B 'server':46B,69B,130C 'servic':58B,114C 'sql':108C 'store':39B,86C,121C 'upload':4A,33B,92C 'user':7A,32B,70B,84C,131C 'vulner':79C 'web':68B,129C 'web-serv':67B,128C 'whose':116C 'write':52B,104C","nicknames":[],"mitigations":[],"who_affected":"Any site running OpenEMR before 8.5.0 where billing users can upload ERA files. The path needs an authenticated billing account, and the second stage needs a database write flaw such as SQL injection. Installations on 8.5.0 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["openemr"],"ptokens":["openemr"],"labels":["healthcare","high","openemr","package","php","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126428':13A,16A '-2026':12A,15A 'authent':6A 'bill':2A 'code':10A 'cve':11A,14A 'era':3A 'let':5A 'openemr':1A,17A 'php':9A 'run':8A 'upload':4A 'user':7A","search_b":"'8.5.0':27B 'attack':41B,48B 'attacker-control':40B 'authent':30B 'background':57B 'bill':31B 'control':42B 'databas':51B 'era':36B 'file':37B,62B 'healthcar':18B 'host':24B 'let':28B 'load':60B 'malform':35B 'openemr':19B,25B 'packag':20B 'php':21B,43B,64B 'primit':53B 'regist':55B 'run':63B 'self':23B 'self-host':22B 'server':46B,69B 'servic':58B 'store':39B 'upload':33B 'user':32B,70B 'web':68B 'web-serv':67B 'write':52B","search_c":"'8.5.0':73C 'allow':81C 'attack':88C,99C 'attacker-control':87C 'authent':82C 'background':113C 'bill':83C 'code':77C 'contain':74C 'control':89C 'databas':103C 'database-writ':102C 'edi':122C 'era':95C 'era_payments.php':98C 'execut':78C,124C 'file':96C,123C 'inject':109C 'load':119C 'malform':94C 'openemr':71C 'php':90C,125C 'primit':105C 'regist':111C 'remot':76C 'requir':117C 'row':115C 'server':130C 'servic':114C 'sql':108C 'store':86C,121C 'upload':92C 'user':84C,131C 'vulner':79C 'web':129C 'web-serv':128C 'whose':116C 'write':104C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T01:38:25+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126428","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126428","severity":null,"published_at":"2026-11-13T10:17:49+00:00","modified_at":"2026-11-13T10:17:49+00:00","first_seen_at":"2026-11-13T10:47:21+00:00","fetched_at":"2026-11-13T10:47:21+00:00","note":null}],"documents":[{"id":145100,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-r6wm-8m2j-c3q9","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-28T01:38:25+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145101,"url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-rce-via-stored-era-upload-and-background-services","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}