OpenEMR versions before 8.3.0 contain a path traversal flaw in the sl_eob_process.php script (CWE‑22). Unchecked eraname values enable authenticated users to craft URLs with '../' sequences that write arbitrary .html files anywhere the web server can write, and to read and echo raw .edi file contents into those reports. The flaw effectively grants file write/read capabilities to any authenticated user possessing this endpoint, potentially exposing sensitive data or enabling further exploitation through crafted files.

All OpenEMR deployments running any version older than 8.3.0 are affected. This includes the 8.2.x line and earlier releases of the OpenEMR software.

The vulnerability carries a CVSS score of 7.2, indicating a high impact. No EPSS score is available, so the current exploitation probability cannot be quantified. It is not listed in the CISA KEV catalog. Attackers would need authenticated access to the web application and the ability to invoke the sl_eob_process.php endpoint, which can be invoked by any authenticated user, even those without billing privileges. Once in place, they can place files in arbitrary locations and read sensitive data from the server.