CVE-2026-33913: OpenEMR Path Traversal Vulnerability

CVE-2026-33913 Overview

CVE-2026-33913 is an XML External Entity (XXE) injection vulnerability in OpenEMR, a widely-used open source electronic health records (EHR) and medical practice management application. The vulnerability exists in versions prior to 8.0.0.3 and allows authenticated users with access to the Carecoordination module to read arbitrary files from the server by uploading a specially crafted CCDA (Consolidated Clinical Document Architecture) document containing malicious XML entity references.

Critical Impact

Authenticated attackers can exfiltrate sensitive server files including /etc/passwd, configuration files, database credentials, and potentially protected health information (PHI) stored on the filesystem, leading to serious data breaches in healthcare environments.

Affected Products

• OpenEMR versions prior to 8.0.0.3
• OpenEMR installations with Carecoordination module enabled
• Healthcare systems running vulnerable OpenEMR deployments

Discovery Timeline

• 2026-03-25 - CVE-2026-33913 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-33913

Vulnerability Analysis

This vulnerability (CWE-611: Improper Restriction of XML External Entity Reference) occurs during the processing of CCDA documents uploaded through the Carecoordination module. CCDA is an XML-based standard used for exchanging clinical documents between healthcare systems. When the application parses uploaded CCDA documents, it fails to properly disable external entity processing in the underlying XML parser.

The attack requires authentication and access to the Carecoordination module, limiting the attack surface to users who already have some level of access to the OpenEMR system. However, given the sensitive nature of healthcare data and the potential for insider threats or compromised accounts, this vulnerability poses significant risk to healthcare organizations.

Root Cause

The root cause is improper configuration of the XML parser used to process CCDA documents. The parser allows external entity resolution, which enables attackers to reference local files on the server through the xi:include directive or standard XXE entity declarations. The application does not disable features like LIBXML_NOENT or implement proper XML external entity restrictions before parsing user-supplied CCDA content.

Attack Vector

An authenticated attacker with access to the Carecoordination module can exploit this vulnerability by crafting a malicious CCDA document containing an XML Include (XInclude) directive. The attack vector is network-based and requires high privileges (authenticated user with module access).

The exploitation technique involves embedding an xi:include directive such as <xi:include href="file:///etc/passwd" parse="text"/> within the CCDA document structure. When the server processes this document, the XML parser resolves the external reference and includes the contents of the specified file in the parsed result. The attacker can then retrieve sensitive file contents through the application's response or error messages.

For detailed technical information about the vulnerability mechanism, refer to the GitHub Security Advisory GHSA-9757-3cfj-wc8q.

Detection Methods for CVE-2026-33913

Indicators of Compromise

• Unusual file access patterns in web server logs, particularly requests to the Carecoordination module with large response sizes
• CCDA document uploads containing suspicious XML entities or xi:include directives
• Error logs showing attempts to access system files like /etc/passwd, /etc/shadow, or application configuration files
• Unexpected outbound connections from the web server if external DTD references are used

Detection Strategies

• Monitor and analyze CCDA document uploads for malicious XML entity declarations or XInclude directives
• Implement Web Application Firewall (WAF) rules to detect XXE attack patterns in incoming XML payloads
• Review application logs for unusual Carecoordination module activity, especially from accounts with elevated access
• Deploy file integrity monitoring on sensitive system and configuration files

Monitoring Recommendations

• Enable detailed logging for the Carecoordination module and CCDA document processing functions
• Configure SIEM alerts for patterns consistent with XXE exploitation attempts in HTTP request bodies
• Monitor for anomalous file read operations by the web server process
• Track user activity within the Carecoordination module for unusual document upload patterns

How to Mitigate CVE-2026-33913

Immediate Actions Required

• Upgrade OpenEMR to version 8.0.0.3 or later immediately
• Audit Carecoordination module access and restrict permissions to only essential personnel
• Review recent CCDA document uploads for signs of exploitation attempts
• Implement network segmentation to limit the impact of potential data exfiltration

Patch Information

OpenEMR has released version 8.0.0.3 which addresses this vulnerability. The fix is available in the GitHub commit 67e1702c41cf486af0069bdafce19860e2cd9a11. Organizations should update to this version or later as documented in the GitHub Release Version 8.0.0.3.

Workarounds

• Disable or restrict access to the Carecoordination module until patching is complete
• Implement WAF rules to filter XML payloads containing external entity declarations or XInclude directives
• Configure PHP's libxml to disable entity loading by setting libxml_disable_entity_loader(true) at the application level
• Apply principle of least privilege to limit which users have access to document upload functionality

# Example: Restrict Carecoordination module access via Apache configuration
<Directory /var/www/openemr/interface/modules/zend_modules/module/Carecoordination>
    Require valid-user
    Require group carecoord_admins
</Directory>