Improper access control in OpenEMR - #VU158834
Published: November 3, 2026
Vulnerability details
The vulnerability allows a remote user to disclose sensitive files from OpenEMR's shared temporary directory, including complete patient clinical documents.
The vulnerability exists due to improper access control in OpenEMR's claim downloader at /interface/billing/get_claim_file.php when handling requests for files in the shared temporary directory. A remote user can use an account with acct/eob or acct/bill write access to submit location=tmp and a predictable file basename in the key parameter to download unrelated files readable by the PHP process without verification that they are claims generated for the caller.
The external C-CDA validator leaves a predictable file in the shared temporary directory after the validation request.