CVE-2026-33301

The record

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, users with the `Notes - my encounters` role can fill Eye Exam forms in patient encounters. The answers to the form can be printed out in PDF form. An arbitrary file read vulnerability was identified in the PDF creation function where the form answers are parsed as unescaped HTML, allowing an attacker to include arbitrary image files from the server in the generated PDF. Version 8.0.0.2 fixes the issue.

Affected packages

Related vulnerabilities

• CVE-2026-113732 virtualenv is a tool for creating isolated virtual python environments. CWE-116
• CVE-2026-113726 virtualenv is a tool for creating isolated virtual python environments. CWE-116
• CVE-2026-113725 virtualenv is a tool for creating isolated virtual python environments. CWE-116
• CVE-2026-104250 The unstructured library provides open-source components for ingesting and pre-processing… CWE-116
• CVE-2026-107823 MariaDB server is a community developed fork of MySQL server. CWE-116
• CVE-2026-106444 Handlebars provides the power necessary to let users build semantic templates. CWE-116
• CVE-2026-77404 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. CWE-116
• CVE-2026-88060 Angular is a development platform for building mobile and desktop web applications using… CWE-116