CVE-2026-124450

Summary

OpenEMR before 8.3.0 has broken access control and path traversal in the fax/sms module's disposeDocument action due to insufficient validation of the file_path parameter. Authenticated low-privilege users can read sensitive files like sqlconf.php to steal database credentials and write arbitrary files as the web server user, leading to remote code execution.

Exploitability

Exploitation requires only valid low-privilege authentication and is straightforward due to lack of input sanitization and access checks on a public-facing endpoint.

Blast radius

Successful exploitation grants attackers database credentials and the ability to execute arbitrary code on the server, potentially compromising all data and systems accessible to the web server user.

Detection

Defenders should monitor for HTTP requests to /fax/sms/disposeDocument.php with file_path parameters containing directory traversal sequences (e.g., ../../) or attempts to read sensitive files like sqlconf.php; such requests from low-privilege users are anomalous and indicate exploitation attempts.

Prioritized remediation

Upgrade to OpenEMR version 8.3.0 or later, which patches the access control and path traversal flaws in the fax/sms module.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.