OpenEMR versions before 8.0.0.2 are vulnerable to an arbitrary file read flaw that allows authenticated attackers to access sensitive server files.

This vulnerability occurs in the PDF creation function where form answers are parsed as unescaped HTML. An attacker with the Notes - my encounters role can exploit this to include arbitrary image files or read local files from the server.

The ability to read arbitrary files on a server hosting electronic health records presents a severe risk to data confidentiality and regulatory compliance, such as HIPAA. An attacker could potentially extract configuration files, credentials, or sensitive patient data. Although the CVSS score of 8.1 reflects a high severity, the requirement for an authenticated user slightly limits the immediate attack surface.

Immediate Action: Update OpenEMR to version 8.0.0.2 or later immediately to apply the required fix for output escaping.

Proactive Monitoring: Review audit logs for unusual PDF generation requests or attempts to access system-level files through application functions.

Compensating Controls: Implement a Web Application Firewall (WAF) to inspect outgoing traffic and block unexpected file paths or malicious HTML tags in form inputs.

Public Exploit Available: Unknown

Given the sensitive nature of medical practice management data, organizations should prioritize patching this vulnerability immediately. While it requires a valid user account, the potential for unauthorized data exfiltration is significant, and administrators should ensure all instances are updated to version 8.0.0.2 to close this security gap.