Vulnerability record · CVE-2020-19364 · published 20 January 2021
CVE-2020-19364: OpenEMR unrestricted file upload enables PHP code execution
Open Emr · Openemr
OpenEMR 5.0.1 permits an authenticated attacker to upload and execute malicious PHP scripts through /controller.php. Because uploaded files can be executed as PHP, the flaw turns a low-privileged account into remote code execution on the web server. This matters for any exposed OpenEMR deployment, since the application handles sensitive patient data.
Description
OpenEMR 5.0.1 allows an authenticated attacker to upload and execute malicious PHP scripts through /controller.php.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityAuthenticated remote code execution with a high CVSS score and very high EPSS, though it requires a valid account and is not in KEV.
What it is
OpenEMR 5.0.1 permits an authenticated attacker to upload and execute malicious PHP scripts through /controller.php. Because uploaded files can be executed as PHP, the flaw turns a low-privileged account into remote code execution on the web server. This matters for any exposed OpenEMR deployment, since the application handles sensitive patient data.
Impact
An attacker with a valid account gains remote code execution with the web server's privileges, allowing full compromise of the application and its data. CVSS 3.1 scores it 8.8 (HIGH) with high confidentiality, integrity and availability impact.
Attack surface
Reached over the network via HTTP requests to /controller.php; the CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates a low-privileged authenticated account is required and no user interaction is needed. No unauthenticated path is described in the record.
Exploitation
Not listed in CISA KEV and no ransomware usage is documented, but EPSS is 0.70575 (99.4th percentile) and both references are tagged Exploit, indicating public exploit material exists. The record does not state whether exploitation has been observed in the wild.
What to do
- Upgrade OpenEMR to a release later than 5.0.1 that fixes the /controller.php upload handling; patch first.
- Restrict upload handling so files are validated by type and stored outside the web root, and disable PHP execution in any upload directory.
- Limit accounts that can reach /controller.php and enforce least privilege for authenticated users.
- Place the OpenEMR interface behind authentication-aware access controls or a VPN and monitor for anomalous upload requests.
Detection
- Monitor web logs for POST requests to /controller.php that carry file uploads, especially PHP content types or .php filenames.
- Alert on newly created .php files in upload or writable directories and on unexpected child processes spawned by the web server.
- Review OpenEMR audit logs for upload activity from accounts that do not normally upload files.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://github.com/EmreOvunc/OpenEMR_Vulnerabilities | ExploitThird Party Advisory |
| https://github.com/EmreOvunc/OpenEMR_Vulnerabilities | ExploitThird Party Advisory |
Track CVE-2020-19364 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2020-19364), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
