This vulnerability allows an authenticated user with permissions to the Carecoordination module to upload a specially crafted CCDA file that includes a XInclude payload. The payload specifies a local file path, enabling the user to read arbitrary files on the server such as /etc/passwd. The attack exploits XML External Entity import to disclose sensitive data, representing a confidentiality breach without execution privileges. It is classified as CWE-611.

The flaw exists in OpenEMR versions earlier than 8.0.0.3. All installations running a vulnerable version and exposing the Carecoordination module are affected.

The CVSS score of 7.7 indicates high severity, while the EPSS score of less than 1% suggests a low likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack path requires an authenticated user to construct and submit the malicious CCDA file; no elevated privileges or arbitrary code execution are required.