OPENEMR · CVE-2026-126482 · Runtime
NO FIX YET · SEE WHAT TO DO
OpenEMR, an electronic health records system, builds a billing database query by pasting in a claim identifier from uploaded X12 835 remittance files without escaping it. An attacker who can log in with billing permissions, or who supplies a crafted payer file a clerk uploads, can read any table including password hashes and modify data.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any OpenEMR deployment before 8.5.0 where users with billing permissions can upload ERA files. Exposure comes from the billing path that reads claim identifiers from those files, so installations without billing use or with no upload access are less exposed. The sources do not say whether the flaw is reachable without a login.
Not affected if no-billing-module, version-8.5.0-or-later
Who cares healthcare, openemr, php, self-hosted
version.php; versions before 8.5.0 are affected.8.5.0 or later.OpenEMR before 8.5.0 contains an SQL injection vulnerability in SLEOB::slInvoiceNumber() in src/Billing/SLEOB.php, which concatenates the CLP01 claim identifier from uploaded X12 835 ERA files into a query without escaping or parameter binding. Authenticated users with billing permissions, or a malicious payer whose ERA file a clerk uploads, can execute arbitrary SQL to read any table, including users_secure password hashes, and modify data.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.