CVE-2026-33321: OpenEMR SSRF Vulnerability

CVE-2026-33321 Overview

CVE-2026-33321 is an Out-of-Band Server-Side Request Forgery (OOB SSRF) vulnerability discovered in OpenEMR, a free and open source electronic health records (EHR) and medical practice management application. The vulnerability exists in the PDF creation functionality where Eye Exam form answers are parsed as unescaped HTML, allowing authenticated attackers with the Notes - my encounters role to forge requests from the server to external or internal resources.

Critical Impact
Authenticated attackers can leverage this SSRF vulnerability to access internal network resources, potentially exfiltrating sensitive patient health information or pivoting to other internal systems from the OpenEMR server.

Affected Products

OpenEMR versions prior to 8.0.0.2
OpenEMR installations with Eye Exam form functionality enabled
Systems where users have the Notes - my encounters role

Discovery Timeline

2026-03-19 - CVE CVE-2026-33321 published to NVD
2026-03-19 - Last updated in NVD database

Technical Details for CVE-2026-33321

Vulnerability Analysis

This vulnerability is classified as CWE-918 (Server-Side Request Forgery), which occurs when a web application fetches remote resources based on user-supplied input without proper validation. In the context of OpenEMR, the flaw manifests in the PDF generation functionality used to export Eye Exam form data.

Users with the Notes - my encounters role have legitimate access to fill out Eye Exam forms within patient encounters. When these forms are exported to PDF format, the application processes form field answers without properly escaping or sanitizing HTML content. This allows an attacker to inject malicious HTML elements containing references to attacker-controlled or internal URLs.

The Out-of-Band (OOB) nature of this SSRF means the attacker may not receive direct responses from the forged requests but can still exfiltrate data through DNS lookups or HTTP callbacks to external servers they control. In healthcare environments, this poses significant risks as it could potentially expose protected health information (PHI) or provide attackers with reconnaissance capabilities against internal network infrastructure.

Root Cause

The root cause of this vulnerability is insufficient input validation and output encoding in the PDF generation module. When Eye Exam form data is processed for PDF creation, the application fails to escape HTML entities in user-supplied form answers. This allows HTML tags containing external resource references (such as <img>, <iframe>, or <link> elements) to be interpreted and rendered during PDF generation, causing the server to make unintended HTTP requests to arbitrary destinations.

Attack Vector

The attack requires network access and low-privilege authentication (specifically the Notes - my encounters role). An attacker would:

Authenticate to OpenEMR with a user account having the Notes - my encounters permission
Access a patient encounter and navigate to the Eye Exam form
Inject malicious HTML payloads into form fields that reference internal or external URLs
Trigger the PDF export functionality to cause the server to process the malicious HTML
The server makes requests to the attacker-specified URLs, potentially leaking internal data or enabling network reconnaissance

The vulnerability does not require user interaction beyond the attacker's own actions, and the low complexity of exploitation combined with network accessibility increases the overall risk profile.

Detection Methods for CVE-2026-33321

Indicators of Compromise

Unusual outbound HTTP/HTTPS requests originating from the OpenEMR server to external IP addresses or domains
DNS queries from the OpenEMR server to suspicious or uncommon domains
Eye Exam form entries containing HTML tags, especially elements like <img>, <iframe>, <script>, or <link>
Abnormal PDF generation activity or errors in the Eye Exam module

Detection Strategies

Implement web application firewall (WAF) rules to detect HTML injection attempts in form submissions
Monitor application logs for PDF generation errors or unusual processing patterns
Deploy network monitoring to detect unexpected outbound connections from the OpenEMR server
Use intrusion detection systems (IDS) to alert on SSRF-related traffic patterns

Monitoring Recommendations

Enable detailed logging for all PDF generation operations in OpenEMR
Configure network egress filtering and alerting for the OpenEMR server
Implement data loss prevention (DLP) monitoring for potential PHI exfiltration attempts
Regularly audit user accounts with the Notes - my encounters role for suspicious activity

How to Mitigate CVE-2026-33321

Immediate Actions Required

Upgrade OpenEMR to version 8.0.0.2 or later immediately
Audit existing Eye Exam form entries for suspicious HTML content
Review access logs for users with the Notes - my encounters role
Implement network egress restrictions on the OpenEMR server to limit outbound connections

Patch Information

The vulnerability has been fixed in OpenEMR version 8.0.0.2. The fix is available through the official GitHub commit (commit hash: dccc962f06bdf6105ca85c277915167caf3e7c28). Organizations should update their OpenEMR installations through standard upgrade procedures. For detailed information about the security issue, refer to the GitHub Security Advisory GHSA-5pc3-2crw-96rv.

Workarounds

Restrict the Notes - my encounters role to only essential trusted personnel until patching is complete
Implement network segmentation to isolate the OpenEMR server from sensitive internal resources
Deploy a web application firewall with rules to block HTML injection in form fields
Disable or restrict PDF export functionality for Eye Exam forms if not operationally required

bash

# Network egress restriction example using iptables
# Limit outbound connections from OpenEMR server to essential services only
iptables -A OUTPUT -m owner --uid-owner www-data -d 127.0.0.1 -j ACCEPT
iptables -A OUTPUT -m owner --uid-owner www-data -p tcp --dport 443 -d trusted-update-server.example.com -j ACCEPT
iptables -A OUTPUT -m owner --uid-owner www-data -j LOG --log-prefix "OPENEMR_EGRESS_BLOCKED: "
iptables -A OUTPUT -m owner --uid-owner www-data -j DROP