PT-2026-21823 · Openemr · Openemr

Denizparlak · Published 2026-02-25 · Updated 2026-02-25 · CVE-2026-24847

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.0.0

Description OpenEMR is an electronic health records and medical practice management application. Prior to version 8.0.0, the Eye Exam form module allows an authenticated user to be redirected to an arbitrary external URL. This could be used for phishing attacks targeting healthcare providers. The Eye Exam form module is the component affected.

Recommendations Update to version 8.0.0 or later.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2026-24847

GHSA-6F42-6Q2R-FC2H

Affected Products

Openemr

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24847.json · Exploit
• https://github.com/openemr/openemr/security/advisories/GHSA-6f42-6q2r-fc2h · Vendor Advisory
• https://github.com/openemr/openemr/commit/b924459bb5b2844f8f5d3d6cedd2e854eda20aad · Patch
• https://osv.dev/vulnerability/CVE-2026-24847 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24847 · Security Note
• https://twitter.com/VulmonFeeds/status/2026622293510672593 · Twitter Post
• https://twitter.com/CVEnew/status/2026641387794395568 · Twitter Post