{"id":"CVE-2026-126460","kind":"vulnerability","aliases":["CVE-2026-126460"],"related":[],"title":"OpenEMR: crafted EDI upload lets billing users run SQL and extract patient data","description":"OpenEMR before 8.5.0 contains a persistent SQL injection vulnerability in SLEOB::slInvoiceNumber(), where the CLP01 claim control number from uploaded X12 835 ERA files is concatenated unescaped into a query. Attackers with billing write access can upload a crafted .edi file via sl_eob_search.php that is stored on the server and re-executes a time-based payload whenever it is reprocessed through sl_eob_process.php, extracting patient health information.","summary":"OpenEMR before 8.5.0 concatenates the CLP01 claim control number from uploaded X12 835 ERA files into a SQL query without escaping. A user with billing write access can upload a crafted file that is stored and triggers a time-based SQL injection when reprocessed, extracting patient health information.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","php","runtime","self-hosted"],"not_affected_if":["no-billing-write-access","openemr-8.5.0-or-later"],"how_to_check":"- Check the installed OpenEMR version in the admin footer or `version.php` and compare against `8.5.0`\n- Review who holds billing write access, since they can upload ERA files","fix":"- OpenEMR: move to `8.5.0` or later","status":"open","published_at":"2026-11-13T10:17:54+00:00","first_seen_at":"2026-11-13T10:47:24+00:00","triaged_at":"2026-11-13T10:53:03+00:00","updated_at":"2026-11-13T10:53:03+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-13T10:53:03Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: move to `8.5.0` or later","reach":"network","title":"OpenEMR: crafted EDI upload lets billing users run SQL and extract patient data","impact":"high","summary":"OpenEMR before 8.5.0 concatenates the CLP01 claim control number from uploaded X12 835 ERA files into a SQL query without escaping. A user with billing write access can upload a crafted file that is stored and triggers a time-based SQL injection when reprocessed, extracting patient health information.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["openemr","healthcare","self-hosted","php"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"attacker extracts patient health information from the database","analyst_note":"","how_to_check":"- Check the installed OpenEMR version in the admin footer or `version.php` and compare against `8.5.0`\n- Review who holds billing write access, since they can upload ERA files","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["openemr-8.5.0-or-later","no-billing-write-access"],"who_is_affected":"Any OpenEMR install before 8.5.0 where users with billing write access can upload ERA (835) files through the eligibility or EOB search pages. Installs that do not process ERA files or that restrict billing write access to trusted staff have a smaller exposure, but the sources do not say whether those paths are reachable by default.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000739,"input_tokens":4672,"output_tokens":544,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126460':16A,19A '-2026':15A,18A '8.5.0':29B,78C '835':39B,97C 'access':53B,110C 'attack':106C 'base':67B,132C 'bill':6A,51B,108C 'claim':33B,91C 'clp01':32B,90C 'concaten':30B,101C 'contain':79C 'control':34B,92C 'craft':2A,57B,114C 'cve':14A,17A 'data':13A 'edi':3A,115C 'era':40B,98C 'escap':47B 'execut':128C 'extract':11A,72B,140C 'file':41B,58B,99C,116C 'health':74B,142C 'healthcar':20B 'host':26B 'inform':75B,143C 'inject':69B,83C 'let':5A 'number':35B,93C 'openemr':1A,21B,27B,76C 'patient':12A,73B,141C 'payload':133C 'persist':81C 'php':22B 'queri':45B,105C 're':127C 're-execut':126C 'reprocess':71B,137C 'run':8A 'runtim':23B 'self':25B 'self-host':24B 'server':124C 'sl_eob_process.php':139C 'sl_eob_search.php':118C 'sleob':86C 'slinvoicenumb':87C 'sql':9A,44B,68B,82C 'store':61B,121C 'time':66B,131C 'time-bas':65B,130C 'trigger':63B 'unescap':102C 'upload':4A,37B,55B,95C,112C 'user':7A,49B 'via':117C 'vulner':84C 'whenev':134C 'without':46B 'write':52B,109C 'x12':38B,96C","nicknames":[],"mitigations":[],"who_affected":"Any OpenEMR install before 8.5.0 where users with billing write access can upload ERA (835) files through the eligibility or EOB search pages. Installs that do not process ERA files or that restrict billing write access to trusted staff have a smaller exposure, but the sources do not say whether those paths are reachable by default.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","high","openemr","php","runtime","selfhosted"],"campaign_type":null,"search_a":"'-126460':16A,19A '-2026':15A,18A 'bill':6A 'craft':2A 'cve':14A,17A 'data':13A 'edi':3A 'extract':11A 'let':5A 'openemr':1A 'patient':12A 'run':8A 'sql':9A 'upload':4A 'user':7A","search_b":"'8.5.0':29B '835':39B 'access':53B 'base':67B 'bill':51B 'claim':33B 'clp01':32B 'concaten':30B 'control':34B 'craft':57B 'era':40B 'escap':47B 'extract':72B 'file':41B,58B 'health':74B 'healthcar':20B 'host':26B 'inform':75B 'inject':69B 'number':35B 'openemr':21B,27B 'patient':73B 'php':22B 'queri':45B 'reprocess':71B 'runtim':23B 'self':25B 'self-host':24B 'sql':44B,68B 'store':61B 'time':66B 'time-bas':65B 'trigger':63B 'upload':37B,55B 'user':49B 'without':46B 'write':52B 'x12':38B","search_c":"'8.5.0':78C '835':97C 'access':110C 'attack':106C 'base':132C 'bill':108C 'claim':91C 'clp01':90C 'concaten':101C 'contain':79C 'control':92C 'craft':114C 'edi':115C 'era':98C 'execut':128C 'extract':140C 'file':99C,116C 'health':142C 'inform':143C 'inject':83C 'number':93C 'openemr':76C 'patient':141C 'payload':133C 'persist':81C 'queri':105C 're':127C 're-execut':126C 'reprocess':137C 'server':124C 'sl_eob_process.php':139C 'sl_eob_search.php':118C 'sleob':86C 'slinvoicenumb':87C 'sql':82C 'store':121C 'time':131C 'time-bas':130C 'unescap':102C 'upload':95C,112C 'via':117C 'vulner':84C 'whenev':134C 'write':109C 'x12':96C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T01:30:25+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126460","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126460","severity":null,"published_at":"2026-11-13T10:17:54+00:00","modified_at":"2026-11-13T10:17:54+00:00","first_seen_at":"2026-11-13T10:47:24+00:00","fetched_at":"2026-11-13T10:47:24+00:00","note":null}],"documents":[{"id":145163,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-hqjp-rcv8-7p9c","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-28T01:30:25+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145164,"url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-persistent-sql-injection-via-era-file-reprocessing","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}