CVE-2026-33301 Overview
OpenEMR is a free and open source electronic health records and medical practice management application. A significant arbitrary file read vulnerability has been identified in versions prior to 8.0.0.2. Users with the Notes - my encounters role can fill Eye Exam forms in patient encounters. The answers to the form can be printed out in PDF form. An arbitrary file read vulnerability was identified in the PDF creation function where the form answers are parsed as unescaped HTML, allowing an attacker to include arbitrary image files from the server in the generated PDF.
Critical Impact
Authenticated attackers with minimal privileges can read arbitrary files from the server, potentially exposing sensitive configuration files, patient records, and system credentials stored on the healthcare system.
Affected Products
- OpenEMR versions prior to 8.0.0.2
- OpenEMR Eye Exam PDF generation functionality
- Systems where users have Notes - my encounters role permissions
Discovery Timeline
- 2026-03-19 - CVE CVE-2026-33301 published to NVD
- 2026-03-19 - Last updated in NVD database
Technical Details for CVE-2026-33301
Vulnerability Analysis
This vulnerability is classified as CWE-116 (Improper Encoding or Escaping of Output), manifesting in OpenEMR's PDF generation functionality for Eye Exam forms. The core issue stems from the application's failure to properly sanitize HTML content when processing form answers before rendering them into PDF documents.
When a user with the Notes - my encounters role submits an Eye Exam form, the application processes the form fields and generates a PDF document. During this process, the form answer content is parsed as raw HTML without proper escaping or validation. This allows an attacker to inject HTML tags, including image tags with file:// protocol references or server-side file paths, which are then processed by the PDF generation engine.
The PDF rendering engine interprets these injected HTML elements and attempts to fetch and embed the referenced resources. When an attacker specifies local file paths pointing to server-side files, the PDF engine reads these files and includes their contents in the generated PDF output. This effectively transforms a seemingly benign PDF export feature into an arbitrary file disclosure mechanism.
Root Cause
The root cause lies in improper output encoding within the PDF generation pipeline. The application fails to escape or sanitize user-controlled input from Eye Exam form fields before passing them to the PDF rendering engine. This allows HTML injection that the PDF generator interprets as legitimate markup, processing embedded file references and including their contents in the output document. The vulnerability specifically affects the form answer parsing logic where user input is concatenated directly into the HTML template without proper encoding.
Attack Vector
The attack requires network access and low-privilege authentication (the Notes - my encounters role). An attacker can exploit this vulnerability by:
- Authenticating to OpenEMR with a user account that has the Notes - my encounters role
- Navigating to a patient encounter and filling out an Eye Exam form
- Injecting malicious HTML containing file references into form answer fields
- Generating the PDF export, which causes the server to read the specified files
- Downloading the generated PDF to exfiltrate the file contents
The vulnerability allows reading arbitrary image files from the server. In healthcare environments, this could expose sensitive configuration files, database credentials, SSL certificates, or other protected server-side resources. The attack requires no user interaction beyond the initial authentication and can be performed by any user with the minimal required role.
Detection Methods for CVE-2026-33301
Indicators of Compromise
- Unusual file access patterns in web server logs during PDF generation requests
- Eye Exam form submissions containing HTML tags or file path references
- PDF generation requests followed by abnormal server file read operations
- Log entries showing attempts to access system files like /etc/passwd or configuration files during form processing
Detection Strategies
- Monitor application logs for Eye Exam form submissions containing suspicious HTML patterns such as <img src="file:// or similar file inclusion attempts
- Implement web application firewall rules to detect HTML injection attempts in form fields
- Review audit logs for users with Notes - my encounters role generating unusually high volumes of PDF exports
- Deploy file integrity monitoring on sensitive server-side files to detect unauthorized read access
Monitoring Recommendations
- Enable verbose logging for PDF generation functionality to capture input parameters
- Configure alerting for requests to the Eye Exam PDF export endpoint that contain encoded or plaintext HTML tags
- Monitor for anomalous file system access patterns correlated with web application requests
- Implement network-level monitoring for large PDF file downloads that may indicate data exfiltration
How to Mitigate CVE-2026-33301
Immediate Actions Required
- Upgrade OpenEMR to version 8.0.0.2 or later immediately
- Review access controls and audit users with the Notes - my encounters role
- Examine recent PDF generation logs for potential exploitation attempts
- Consider temporarily disabling the Eye Exam PDF export feature if immediate patching is not possible
Patch Information
OpenEMR has released version 8.0.0.2 which addresses this vulnerability. The fix involves proper HTML escaping of form answers before they are processed by the PDF generation engine. The specific commit addressing this issue is available in the OpenEMR GitHub repository. Additional details are documented in the GitHub Security Advisory.
Workarounds
- Temporarily disable the Eye Exam PDF export functionality until patching is complete
- Restrict the Notes - my encounters role to only trusted users with verified need
- Implement input validation at the web server or reverse proxy level to filter HTML tags from form submissions
- Deploy a web application firewall with rules to block common HTML injection patterns in form data
# Example: Restrict access to PDF generation endpoint via Apache configuration
<Location "/interface/forms/eye_mag/pdf.php">
# Temporarily restrict access while awaiting patch
Require ip 10.0.0.0/8
Require ip 192.168.0.0/16
</Location>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
