CVE-2026-33913: 
OpenEMR vulnerability analysis and mitigation

CVE-2026-33913 is an XInclude injection vulnerability (a variant of XML External Entity injection) in OpenEMR's Carecoordination module that allows an authenticated user to read arbitrary files from the server. It affects all OpenEMR versions prior to 8.0.0.3 and was disclosed on March 25, 2026, when the patched version was simultaneously released. The vulnerability carries a CVSS v3.1 base score of 7.7 (High) per the GitHub Security Advisory, reflecting network-accessible exploitation with low privileges required and high confidentiality impact (GitHub Advisory, OpenEMR Release).

The root cause is classified as CWE-611 (Improper Restriction of XML External Entity Reference). The vulnerable code resides in src/Services/Cda/XmlExtended.php, which extends Laminas\Config\Reader\Xml and passes the LIBXML_XINCLUDE flag to both XMLReader::open() (line 39) and XMLReader::XML() (line 73) when parsing uploaded CCDA documents. This flag was introduced in commit 1024a1a (PR #5870, November 2022) for large document support but was never security-reviewed. The input sanitizer cleanCcdaXmlContent() uses DOMDocument without LIBXML_XINCLUDE, so malicious <xi:include> elements pass through as inert markup and are only activated when XmlExtended::fromString() processes the output — bypassing PHP 8.x's default XXE protections, which do not cover the separate XInclude processing pipeline. An attacker crafts a CCDA XML file embedding <xi:include href="file:///etc/passwd" parse="text"/> and uploads it via the Carecoordination module's import interface (GitHub Advisory, Patch Commit).

Successful exploitation allows an authenticated attacker to read any file accessible to the web server process, with no impact on integrity or availability. High-value targets include sites/default/sqlconf.php (containing database credentials that could enable full database compromise), /proc/self/environ (environment variables potentially containing secrets), and application source code. In healthcare environments running OpenEMR, this could expose protected health information (PHI), database credentials enabling lateral movement, and other sensitive configuration data (GitHub Advisory).

A proof-of-concept exploit with a complete, reproducible attack sequence — including a concrete malicious CCDA XML payload and step-by-step UI navigation — is publicly available in the GitHub Security Advisory (GitHub Advisory). Exploitation requires authentication with admin/super ACL or send_to_hie permission and access to the Carecoordination module, which is enabled by default. The EPSS score is approximately 0.027%, indicating low automated exploitation probability at this time, and there is no evidence of in-the-wild exploitation or CISA KEV catalog listing as of the disclosure date (Feedly).

1. Reconnaissance: Identify OpenEMR instances running versions prior to 8.0.0.3 using version fingerprinting or Shodan/Censys searches for OpenEMR login pages.
2. Authenticate: Log in with an account that has admin/super ACL or send_to_hie permission — any user with Carecoordination module access qualifies.
3. Craft malicious CCDA document: Create a valid CCDA XML file embedding an XInclude directive targeting the desired file, e.g.:

<?xml version="1.0" encoding="UTF-8"?>
<ClinicalDocument xmlns="urn:hl7-org:v3" xmlns:xi="http://www.w3.org/2001/XInclude">
  <recordTarget>
    <patientRole>
      <patient>
        <name><given><xi:include href="file:///etc/passwd" parse="text"/></given></name>
      </patient>
    </patientRole>
  </recordTarget>
</ClinicalDocument>

4. Upload the document: Navigate to Modules → Carecoordination → CCDA tab (Import) and upload the crafted XML file.
5. Retrieve exfiltrated data: Navigate to Modules → Carecoordination → Review and Approve, or query the database directly:

SELECT field_value FROM audit_details WHERE field_name = 'fname' ORDER BY id DESC LIMIT 1;

The patient first name field will contain the contents of the targeted file (e.g., /etc/passwd). 6. Escalate: Repeat targeting sites/default/sqlconf.php to extract database credentials for full database compromise (GitHub Advisory).

• Network: Unusual HTTP POST requests to the Carecoordination CCDA import endpoint containing XML payloads with xi:include or XInclude namespace declarations; outbound file-read activity from the web server process.
• File System: Unexpected access to sensitive files such as /etc/passwd, /proc/self/environ, or sites/default/sqlconf.php by the web server process (e.g., www-data, apache) visible in OS-level audit logs.
• Logs: OpenEMR application logs showing CCDA import activity followed by unusual patient record creation; web server access logs showing POST requests to Carecoordination import endpoints with large or malformed XML bodies.
• Database: Entries in the audit_details table where field_name = 'fname' contains file system content (e.g., lines resembling /etc/passwd format such as root:x:0:0:root:/root:/bin/bash) rather than legitimate patient names (GitHub Advisory).

Upgrade OpenEMR to version 8.0.0.3 or later, which removes the LIBXML_XINCLUDE flag from src/Services/Cda/XmlExtended.php lines 39 and 73 — a minimal, non-breaking change since CCDA/QRDA specifications do not use XInclude (Patch Commit, OpenEMR Release). If immediate patching is not possible, restrict access to the Carecoordination module to only trusted users who require it for legitimate operations, and implement OS-level file system access controls (e.g., AppArmor or SELinux profiles) to limit which files the OpenEMR web server process can read (GitHub Advisory).

The vulnerability was reported by security researcher neosecjp and remediated by OpenEMR developer kojiromike, with the fix and advisory published simultaneously on March 25, 2026 (GitHub Advisory). Red Hat tracked the advisory via their CVE database (Red Hat CVE). Social media activity was limited, with a brief mention on Bluesky and coverage by automated vulnerability tracking services such as The Hacker Wire and CVEFeed shortly after disclosure.