Path Traversal in OpenEMR via X12 835 File Upload

Executive Summary

CVE-2026-126481 is a path traversal vulnerability in OpenEMR versions before 8.5.0. It affects era_payments.php and sl_eob_search.php, allowing authenticated billing users to write files outside the ERA directory by exploiting traversal sequences in uploaded X12 835 files. Attackers can overwrite .edi or .835 files with malicious content in any writable directory.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized file writes in directories writable by the web server, particularly in the ERA directory or /tmp. Review X12 835 file uploads for path traversal sequences like ../ in filenames. Monitor logs for suspicious file operations in era_payments.php and sl_eob_search.php.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to overwrite existing files or plant malicious files in unexpected locations. This can lead to integrity loss, such as overwriting financial records or operational files, and potential availability disruption. If combined with other vulnerabilities, it could escalate to more severe impacts.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenEMR to version 8.5.0 or later. Implement strict filename validation using basename() and regex checks to prevent path traversal. Restrict file write permissions to the ERA directory only. Review and remove any unauthorized files written outside the intended directory.

Useful 0 Not Useful 0