CVE-2026-124457

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.3.0

Description An issue exists in the 'interface/billing/sl eob process.php' endpoint where authenticated users can perform path traversal by providing unsanitized values in the eraname variable. This allows attackers, including those without billing privileges, to use ../ sequences to create ERA report .html files in any directory writable by the web user and parse arbitrary .edi files (Electronic Data Interchange files used for healthcare transactions) that are echoed into the report.

Recommendations Update to version 8.3.0 or later. Restrict access to the 'interface/billing/sl eob process.php' endpoint to only authorized users with billing privileges.