{"id":"CVE-2026-126482","kind":"vulnerability","aliases":["CVE-2026-126482"],"related":[],"title":"OpenEMR: uploaded billing file lets a user run arbitrary SQL queries","description":"OpenEMR before 8.5.0 contains an SQL injection vulnerability in SLEOB::slInvoiceNumber() in src/Billing/SLEOB.php, which concatenates the CLP01 claim identifier from uploaded X12 835 ERA files into a query without escaping or parameter binding. Authenticated users with billing permissions, or a malicious payer whose ERA file a clerk uploads, can execute arbitrary SQL to read any table, including users_secure password hashes, and modify data.","summary":"OpenEMR, an electronic health records system, builds a billing database query by pasting in a claim identifier from uploaded X12 835 remittance files without escaping it. An attacker who can log in with billing permissions, or who supplies a crafted payer file a clerk uploads, can read any table including password hashes and modify data.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"OpenEMR","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["healthcare","openemr","php","runtime","self-hosted"],"not_affected_if":["no-billing-module","version-8.5.0-or-later"],"how_to_check":"- Check the OpenEMR version in the admin footer or `version.php`; versions before `8.5.0` are affected.\n- Confirm whether billing users can upload ERA (X12 835) files through the billing module.","fix":"- Upgrade OpenEMR to `8.5.0` or later.","status":"open","published_at":"2026-11-13T10:17:58+00:00","first_seen_at":"2026-11-13T10:47:26+00:00","triaged_at":"2026-11-13T10:48:49+00:00","updated_at":"2026-11-13T10:48:49+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-13T10:48:49Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade OpenEMR to `8.5.0` or later.","reach":"network","title":"OpenEMR: uploaded billing file lets a user run arbitrary SQL queries","impact":"high","summary":"OpenEMR, an electronic health records system, builds a billing database query by pasting in a claim identifier from uploaded X12 835 remittance files without escaping it. An attacker who can log in with billing permissions, or who supplies a crafted payer file a clerk uploads, can read any table including password hashes and modify data.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["openemr","healthcare","self-hosted","php"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reads password hashes and modifies patient billing data.","analyst_note":"","how_to_check":"- Check the OpenEMR version in the admin footer or `version.php`; versions before `8.5.0` are affected.\n- Confirm whether billing users can upload ERA (X12 835) files through the billing module.","plain_action":"","product_name":"OpenEMR","needs_analyst":false,"not_affected_if":["version-8.5.0-or-later","no-billing-module"],"who_is_affected":"Any OpenEMR deployment before 8.5.0 where users with billing permissions can upload ERA files. Exposure comes from the billing path that reads claim identifiers from those files, so installations without billing use or with no upload access are less exposed. The sources do not say whether the flaw is reachable without a login.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00076,"input_tokens":4682,"output_tokens":584,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126482':14A,17A '-2026':13A,16A '8.5.0':83C '835':46B,103C 'arbitrari':9A,131C 'attack':53B 'authent':114C 'bill':3A,34B,59B,117C 'bind':113C 'build':32B 'claim':41B,98C 'clerk':69B,127C 'clp01':97C 'concaten':95C 'contain':84C 'craft':65B 'cve':12A,15A 'data':80B,144C 'databas':35B 'electron':28B 'era':104C,124C 'escap':50B,110C 'execut':130C 'file':4A,48B,67B,105C,125C 'hash':77B,141C 'health':29B 'healthcar':19B 'host':25B 'identifi':42B,99C 'includ':75B,137C 'inject':87C 'let':5A 'log':56B 'malici':121C 'modifi':79B,143C 'openemr':1A,18A,20B,26B,81C 'paramet':112C 'password':76B,140C 'past':38B 'payer':66B,122C 'permiss':60B,118C 'php':21B 'queri':11A,36B,108C 'read':72B,134C 'record':30B 'remitt':47B 'run':8A 'runtim':22B 'secur':139C 'self':24B 'self-host':23B 'sleob':90C 'slinvoicenumb':91C 'sql':10A,86C,132C 'src/billing/sleob.php':93C 'suppli':63B 'system':31B 'tabl':74B,136C 'upload':2A,44B,70B,101C,128C 'user':7A,115C,138C 'vulner':88C 'whose':123C 'without':49B,109C 'x12':45B,102C","nicknames":[],"mitigations":[],"who_affected":"Any OpenEMR deployment before 8.5.0 where users with billing permissions can upload ERA files. Exposure comes from the billing path that reads claim identifiers from those files, so installations without billing use or with no upload access are less exposed. The sources do not say whether the flaw is reachable without a login.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["openemr"],"ptokens":["openemr"],"labels":["healthcare","high","openemr","php","runtime","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126482':14A,17A '-2026':13A,16A 'arbitrari':9A 'bill':3A 'cve':12A,15A 'file':4A 'let':5A 'openemr':1A,18A 'queri':11A 'run':8A 'sql':10A 'upload':2A 'user':7A","search_b":"'835':46B 'attack':53B 'bill':34B,59B 'build':32B 'claim':41B 'clerk':69B 'craft':65B 'data':80B 'databas':35B 'electron':28B 'escap':50B 'file':48B,67B 'hash':77B 'health':29B 'healthcar':19B 'host':25B 'identifi':42B 'includ':75B 'log':56B 'modifi':79B 'openemr':20B,26B 'password':76B 'past':38B 'payer':66B 'permiss':60B 'php':21B 'queri':36B 'read':72B 'record':30B 'remitt':47B 'runtim':22B 'self':24B 'self-host':23B 'suppli':63B 'system':31B 'tabl':74B 'upload':44B,70B 'without':49B 'x12':45B","search_c":"'8.5.0':83C '835':103C 'arbitrari':131C 'authent':114C 'bill':117C 'bind':113C 'claim':98C 'clerk':127C 'clp01':97C 'concaten':95C 'contain':84C 'data':144C 'era':104C,124C 'escap':110C 'execut':130C 'file':105C,125C 'hash':141C 'identifi':99C 'includ':137C 'inject':87C 'malici':121C 'modifi':143C 'openemr':81C 'paramet':112C 'password':140C 'payer':122C 'permiss':118C 'queri':108C 'read':134C 'secur':139C 'sleob':90C 'slinvoicenumb':91C 'sql':86C,132C 'src/billing/sleob.php':93C 'tabl':136C 'upload':101C,128C 'user':115C,138C 'vulner':88C 'whose':123C 'without':109C 'x12':102C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T01:29:39+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126482","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126482","severity":null,"published_at":"2026-11-13T10:17:58+00:00","modified_at":"2026-11-13T10:17:58+00:00","first_seen_at":"2026-11-13T10:47:26+00:00","fetched_at":"2026-11-13T10:47:26+00:00","note":null}],"documents":[{"id":145207,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-cw3f-mhw8-44jp","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-28T01:29:39+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145208,"url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-sql-injection-via-clp01-element-of-x12-835-era-upload","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}