CVE-2026-33301: 
OpenEMR vulnerability analysis and mitigation

CVE-2026-33301 is an arbitrary image file read vulnerability in OpenEMR's PDF generation function, affecting all versions prior to 8.0.0.2. Authenticated users with the Notes - my encounters role can inject unescaped HTML into Eye Exam form fields, causing the mPDF library to embed arbitrary server-side image files into generated PDF documents. The vulnerability was disclosed on March 19, 2026, and patched in version 8.0.0.2. It carries a CVSS v3.1 base score of 8.1 (High) and a CVSS v4.0 base score of 7.1 (High) (GitHub Advisory).

The root cause is improper encoding or escaping of output (CWE-116): user-supplied form field values in the Eye Exam report template (interface/forms/eye_mag/report.php) are rendered as raw, unescaped HTML when generating PDFs via the mPDF library. An attacker can inject an <img src="file:///path/to/file"> tag into the HPI field of an Eye Exam form; when the PDF is generated, mPDF resolves the file:// URI and embeds the referenced image directly into the PDF output. The fix, applied in commit dccc962, wraps all user-supplied values with OpenEMR's text() escaping function throughout the report template. The advisory also notes a high likelihood that PHP filter chains could extend this to reading arbitrary non-image files, though that vector was not fully demonstrated (GitHub Advisory, Patch Commit).

Successful exploitation allows authenticated attackers to read arbitrary image files from the OpenEMR server's filesystem, which in a healthcare context may include sensitive patient data stored as images (e.g., scanned documents, medical imaging files). The advisory further notes that PHP filter chain abuse could potentially extend the read capability to arbitrary file types, increasing the risk of broader data exfiltration including configuration files, credentials, or other sensitive server content. Availability and system integrity are not directly impacted, but confidentiality of server-side data is severely compromised (GitHub Advisory).

A detailed proof-of-concept is publicly available in the GitHub Security Advisory, including a step-by-step reproduction guide with a concrete payload (<img src=file:///var/www/html/openemr/proof.png>). Exploitation requires a low-privilege authenticated account with the Notes - my encounters role, which is granted by default to the Administrators, Clinicians, and Physicians groups. No in-the-wild exploitation has been observed as of the time of disclosure. The EPSS score is approximately 0.042%, reflecting low but non-zero exploitation probability. This CVE is not currently listed in the CISA KEV catalog (GitHub Advisory, Feedly).

1. Reconnaissance: Identify an OpenEMR instance running a version prior to 8.0.0.2. Confirm the target is accessible and obtain or compromise credentials for an account with the Notes - my encounters role (e.g., a Clinician or Physician account).
2. Identify a target file: Determine a sensitive file path on the server to exfiltrate, such as /var/www/html/openemr/proof.png or another image-format file of interest.
3. Navigate to Eye Exam form: Log in, select or create a patient, create or open a visit encounter, and navigate to Clinical > Eye Exam.
4. Inject the payload: In the HPI > HPI field, insert the malicious HTML payload: <img src="file:///var/www/html/openemr/proof.png"> (substituting the desired file path).
5. Save the form: Click Save to persist the injected payload in the encounter record.
6. Generate the PDF: Click File > Save Report as PDF. The mPDF library processes the unescaped HTML, resolves the file:// URI, and embeds the target image into the PDF.
7. Retrieve the file: Navigate to Patient > Visits > Visit History, open the generated PDF document link, and view the embedded server-side image file within the PDF output (GitHub Advisory).

• Logs: OpenEMR application logs or web server access logs showing PDF generation requests (Save Report as PDF) from accounts with the Notes - my encounters role, particularly from accounts not typically generating reports; database entries in Eye Exam form fields containing <img src="file://... or similar HTML tags.
• File System: Unexpected PDF files in the OpenEMR document store containing embedded images that correspond to server-side file paths rather than patient-uploaded content.
• Network: Absence of outbound network requests (this is a local file read, not SSRF), but unusual PDF download activity from clinician accounts may be observable in proxy or web server logs.
• Database: Queries or stored values in form_eye_mag or related tables containing raw HTML tags such as <img, file://, or PHP filter chain strings (e.g., php://filter) in HPI or other free-text fields (GitHub Advisory).

Upgrade OpenEMR to version 8.0.0.2 or later, which escapes all user-supplied form values in the Eye Exam report template using the text() function, preventing HTML injection into PDF output (Patch Commit). As a temporary workaround prior to patching, restrict the Notes - my encounters role to only fully trusted users, and audit existing group memberships for Administrators, Clinicians, and Physicians to minimize exposure. Additionally, review previously generated Eye Exam PDFs for suspicious embedded image content that may indicate prior exploitation (GitHub Advisory).

The vulnerability was reported by researcher lassiiiiii and published via GitHub's security advisory program on March 19, 2026. The advisory explicitly notes the potential for further exploit development via PHP filter chains to read non-image files, and cross-references related advisories for stored XSS (CVE-2026-33299) and out-of-band SSRF sharing the same root cause. Coverage appeared on security aggregators including RedPacket Security and CVEFeed shortly after disclosure (GitHub Advisory).