CVE-2026-124446

Summary

OpenEMR before 8.3.0 has a path traversal flaw in its FaxSMS module where unsanitized 'file_path' parameters allow authenticated low-privilege users to read or overwrite arbitrary files on the server. This enables theft of sensitive credentials (e.g., from sqlconf.php) or injection of malicious code via file overwrites.

Exploitability

Exploitation requires valid low-privilege authentication and is straightforward due to lack of input sanitization on the file_path parameter in action=download or action=setup endpoints.

Blast radius

Successful exploitation could lead to full system compromise via credential theft, webshell deployment, or data destruction, affecting confidentiality, integrity, and availability simultaneously.

Detection

Defenders should monitor web server access logs for requests to /interface/fax/RCFaxClient.php or SignalWireClient.php with suspicious file_path parameters containing '../' sequences or non-expected paths (e.g., '../../sites/default/sqlconf.php'), especially when paired with action=download or action=setup parameters.

Prioritized remediation

Upgrade to OpenEMR version 8.3.0 or later, which patches the path traversal vulnerability in the FaxSMS module's disposeDocument functions.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.