XML External Entity injection in OpenEMR - CVE-2026-33913
Published: April 23, 2026
Vulnerability identifier: #VU127353
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N]
CVE-ID: CVE-2026-33913
CWE-ID: CWE-611
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper restriction of xml external entity reference in the CCDA import functionality in src/Services/Cda/XmlExtended.php when parsing uploaded CCDA XML with XInclude processing enabled. A remote user can upload a crafted CCDA document containing XInclude directives to disclose sensitive information.
Exploitation requires access to the Carecoordination module, and only instances with that module enabled are vulnerable.
Affected software
OpenEMR
How to mitigate CVE-2026-33913
Install security update from vendor's website.
OpenEMR - update to 8.0.0.3