PT-2026-139972

CVE-2026-124457

·

Published

2026-11-08

·

Updated

2026-11-08

Description by

CVSS 3.1
7.6
High
MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
OpenEMR before 8.3.0 contains a path traversal vulnerability in interface/billing/sl eob process.php that allows authenticated users to write and read files by supplying unsanitized eraname values. Attackers without billing privileges can inject ../ sequences to create ERA report .html files anywhere the web user can write and parse arbitrary .edi files echoed into the report.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')
Related identifiers
CVE-2026-124457
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com