CVE-2026-33301 in OpenEMR
Summary
by MITRE • 03/20/2026
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, users with the `Notes - my encounters` role can fill Eye Exam forms in patient encounters. The answers to the form can be printed out in PDF form. An arbitrary file read vulnerability was identified in the PDF creation function where the form answers are parsed as unescaped HTML, allowing an attacker to include arbitrary image files from the server in the generated PDF. Version 8.0.0.2 fixes the issue.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 03/24/2026
The vulnerability CVE-2026-33301 affects OpenEMR versions prior to 8.0.0.2, representing a critical arbitrary file read flaw within the medical practice management application's PDF generation functionality. This issue specifically targets users possessing the 'Notes - my encounters' role, which grants them the ability to fill Eye Exam forms during patient encounters. The security flaw emerges from inadequate input validation and sanitization within the PDF creation process where form responses are processed as unescaped HTML content. The vulnerability stems from CWE-20, which categorizes improper input handling as a fundamental weakness in software security, particularly when dealing with user-supplied data that gets directly embedded into generated documents without proper sanitization.
The technical exploitation of this vulnerability occurs through the PDF generation function where the Eye Exam form answers are parsed and rendered, allowing attackers to include arbitrary image files from the server filesystem within the generated PDF documents. This creates a path for unauthorized file access and potential data exfiltration, as malicious actors can leverage the unescaped HTML parsing to reference and embed sensitive files from the server. The flaw essentially transforms the PDF generation process into an arbitrary file reading mechanism, enabling attackers to access files that should remain protected within the application's file system. This type of vulnerability aligns with ATT&CK technique T1566.001, which involves the use of malicious file content to gain access to systems, and represents a classic example of how web applications can become attack vectors when user input is not properly validated and sanitized.
The operational impact of this vulnerability extends beyond simple information disclosure, as it provides attackers with potential access to sensitive patient medical data stored within the application's file system. Since the vulnerability allows for arbitrary file reading through PDF generation, threat actors could potentially access not only medical records but also system configuration files, database credentials, or other sensitive artifacts that might be accessible through the web server's file system. The risk is particularly elevated in healthcare environments where compliance with regulations such as HIPAA requires strict protection of patient data, making this vulnerability a significant concern for healthcare organizations utilizing OpenEMR. The vulnerability also demonstrates poor separation of concerns in the application's architecture, where the PDF generation component lacks proper access controls and input sanitization mechanisms.
The mitigation for this vulnerability requires immediate upgrading to OpenEMR version 8.0.0.2 or later, which implements proper input sanitization and prevents the inclusion of arbitrary file references in PDF generation. Organizations should also implement additional security measures including regular security assessments, input validation for all user-supplied content, and monitoring of PDF generation activities. The fix addresses the root cause by ensuring that HTML content from user forms is properly escaped and validated before being processed into PDF documents, thereby eliminating the path for arbitrary file inclusion. Security teams should also consider implementing web application firewalls and access controls to limit the privileges of users with the 'Notes - my encounters' role, ensuring that only authorized personnel can access sensitive functionality. This vulnerability serves as a reminder of the critical importance of input validation in web applications and the potential consequences of inadequate sanitization of user-supplied content in medical applications that handle highly sensitive data.