Path Traversal in OpenEMR Allows File Write/Read

Executive Summary

CVE-2026-124457 is a path traversal vulnerability in OpenEMR versions before 8.3.0. It exists in the file interface/billing/sl_eob_process.php where the 'eraname' parameter is used to construct filesystem paths without proper validation. Attackers can inject directory traversal sequences like '../' to write arbitrary .html files anywhere the web server user has write permissions or read any .edi file on the server.

Useful 0 Not Useful 0

Detection Guidance

Check OpenEMR versions before 8.3.0 by running: grep -r 'openemr' /var/www/html/openemr/version.php or check the version in the web interface footer. Look for suspicious file writes in web directories like /var/www/html/openemr/interface/billing/ with commands like find /var/www/html -name '*.html' -mtime -1 or ls -la /tmp/ | grep -i 'EVIL_TRAV'. Monitor for unexpected .edi file parsing in logs like /var/log/apache2/access.log.

Inspect sl_eob_process.php for unsanitized eraname usage with grep -r 'eraname' /var/www/html/openemr/interface/billing/sl_eob_process.php. Check for CSRF token bypass attempts in logs or network traffic.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to write or read files on the server. They could create malicious .html files in sensitive directories or access confidential .edi files. While direct remote code execution isn't possible due to fixed file extensions, it could lead to data breaches, file integrity issues, or further attacks if combined with other flaws.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. It may result in non-compliance due to potential data breaches, lack of proper access controls, and insufficient file integrity protections.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenEMR to version 8.3.0 or later immediately. If upgrading is not possible, apply path sanitization to eraname by modifying sl_eob_process.php to use basename() and realpath() on the input. Implement strict regex validation for eraname to block ../ sequences.

Restrict file write permissions in /var/www/html/openemr/interface/billing/ to prevent unauthorized file creation. Add ACL checks to ensure only billing-privileged users can access the ERA/EOB processor. Monitor for unusual file writes or .edi file reads in system logs.

Useful 0 Not Useful 0