CVE-2026-126417OpenEMR before 8.5.0 Information Disclosure via get_claim_file.php

Açıklama

OpenEMR before 8.5.0 contains an access control flaw in get_claim_file.php: with location=tmp, it serves any file in the shared temporary directory without verifying the file is a claim for the caller. Users with acct/eob or acct/bill write access can request key=ccda.xml to download the most recently validated patient's complete C-CDA clinical document.

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Kaynaklar ve yamalar

• GitHub Security Advisory (GHSA-9rw5-h7xf-57mc) vendor-advisory
• VulnCheck Advisory: OpenEMR before 8.5.0 Information Disclosure via get_claim_file.php third-party-advisory