OpenEMR versions prior to 8.0.0.3 are vulnerable to arbitrary file disclosure, posing a significant risk to sensitive medical and system data.

This vulnerability is an Improper Restriction of XML External Entity Reference (CWE-611) located in the Carecoordination module. It allows an authenticated user to perform arbitrary file reads by uploading a specially crafted CCDA document.

Successful exploitation of this vulnerability could lead to the unauthorized disclosure of sensitive configuration files, credentials, or protected health information (PHI) stored on the server. Given the CVSS score of 7.7, this represents a high-severity risk to the confidentiality of the medical practice management environment, potentially leading to regulatory non-compliance and severe reputational damage.

Immediate Action: Update OpenEMR to version 8.0.0.3 or later immediately to incorporate the patch addressing the XXE vulnerability.

Proactive Monitoring: Monitor server access logs for anomalous file read requests or unexpected activity originating from the Carecoordination module.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to inspect XML uploads for malicious external entity references as a temporary protective measure.

Public Exploit Available: No

The risk associated with this vulnerability is high due to the potential for unauthorized data exfiltration within a healthcare environment. IT administrators should prioritize the upgrade to version 8.0.0.3 to eliminate the underlying flaw, as the existence of a proof-of-concept underscores the need for rapid remediation to prevent potential exploitation.