Read the docs
TI-2006-05579 Aliases CVE-2006-5795GHSA-rfj9-h276-xxvr

Multiple PHP remote file inclusion vulnerabilities in OpenEMR 2.8.1 and earlier, when…

Priority LOW 39Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

Multiple PHP remote file inclusion vulnerabilities in OpenEMR 2.8.1 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the srcdir parameter to (a) billing_process.php, (b) billing_report.php, (c) billing_report_xml.php, and (d) print_billing_report.php in interface/billing/; (e) login.php; (f) interface/batchcom/batchcom.php; (g) interface/login/login.php; (h) main_info.php and (i) main.php in interface/main/; (j) interface/new/new_patient_save.php; (k) interface/practice/ins_search.php; (l) interface/logout.php; (m) custom_report_range.php, (n) players_report.php, and (o) front_receipts_report.php in interface/reports/; (p) facility_admin.php, (q) usergroup_admin.php, and (r) user_info.php in interface/usergroup/; or (s) custom/import_xml.php.

Why it matters now

EPSS 0.03292 88th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by the CNA and NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:openemr:openemr:*:*:*:*:*:*:*:*up to 2.8.1Vulnerableopenemr
  • cpe:2.3:a:openemr:openemr:*:*:*:*:*:*:*:* Versions up to 2.8.1 Vulnerable ·openemr

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2006-5795
  2. 2026-10-03 Alias added: GHSA-rfj9-h276-xxvr

References

Exploit 2

Advisory 1

Other 1

  • TI-2012-00906 interface/fax/fax_dispatch.php in OpenEMR 4.1.0 allows remote authenticated users to… CVSS 2.0HIGH 8.5
  • TI-2006-02836 PHP remote file inclusion vulnerability in… CVSS 2.0MEDIUM 6.8
  • TI-2006-05595 PHP remote file inclusion vulnerability in library/translation.inc.php in OpenEMR 2.8.1… CVSS 2.0MEDIUM 6.8
  • TI-2012-00905 Multiple directory traversal vulnerabilities in OpenEMR 4.1.0 allow remote authenticated… CVSS 2.0LOW 3.5
  • TI-2007-00633 Variable overwrite vulnerability in interface/globals.php in OpenEMR 2.8.2 and earlier… CVSS 2.0MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences