---
id: "CVE-2026-126481"
page: "https://infrastack.ai/live/CVE-2026-126481"
kind: "vulnerability"
aliases: ["CVE-2026-126481"]
title: "OpenEMR: path traversal in ERA upload lets billing users write files"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["healthcare", "openemr", "package", "php"]
not_affected_if: ["no-billing-users", "version-8.5.0-or-later"]
published_at: "2026-11-13T10:17:57+00:00"
first_seen_at: "2026-11-13T10:47:26+00:00"
updated_at: "2026-11-13T10:52:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126481", "first_seen_at": "2026-11-13T10:47:26+00:00"}]
exploit_sources: []
---

# OpenEMR: path traversal in ERA upload lets billing users write files

Link for people: https://infrastack.ai/live/CVE-2026-126481 (this .md is for agents)

OpenEMR before 8.5.0 has a path traversal flaw in era_payments.php and sl_eob_search.php. An authenticated billing user can embed traversal sequences in an uploaded X12 835 file to write attacker-controlled content to any location the web server can write to.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the OpenEMR version in the installation; versions before `8.5.0` are affected.

## Fix

- Move OpenEMR to `8.5.0` or later.

## Timeline

- 2026-11-13T10:47:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126481

## Documents

- [advisory] Vendor advisory: github.com https://github.com/openemr/openemr/security/advisories/GHSA-mf55-7h68-r2rp
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/openemr-before-8.5.0-path-traversal-via-era-835-file-upload

## From the sources

OpenEMR before 8.5.0 contains a path traversal vulnerability in era_payments.php and sl_eob_search.php that allows authenticated billing users to write files outside the ERA directory. Attackers can embed traversal sequences in the GS04 element of an uploaded X12 835 file to overwrite .edi or .835 files with attacker-controlled content anywhere writable by the web server.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_