CVE-2026-124457 OpenEMR before 8.3.0 Path Traversal via sl_eob_process.php eraname
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-124457?
CVE-2026-124457 is a high-severity vulnerability in openemr, published on 8 Nov 2026.
Official description
OpenEMR before 8.3.0 contains a path traversal vulnerability in interface/billing/sl_eob_process.php that allows authenticated users to write and read files by supplying unsanitized eraname values. Attackers without billing privileges can inject ../ sequences to create ERA report .html files anywhere the web user can write and parse arbitrary .edi files echoed into the report.
Weakness: CWE-22
Which versions are affected by CVE-2026-124457?
How do I fix CVE-2026-124457?
No fix has been published for CVE-2026-124457 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-124457 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-124457 exists.
Sources
Also known as GHSA-7qpc-7f6v-27vh, GHSA-m6q6-5j87-3cmp.