CVE-2026-124467

Summary

OpenEMR before 8.4.0 has a local file inclusion vulnerability in the ESign router where an unsanitized 'module' parameter is passed to require_once, allowing authenticated attackers to include arbitrary PHP files. Combined with the fax module's insecure file upload that writes attacker-controlled files to a predictable temp path without extension checks, this enables remote code execution.

Exploitability

Authenticated attackers with low privileges can exploit this by uploading a malicious Controller.php file via the fax module and then triggering the LFI via the ESign router endpoint.

Blast radius

Successful exploitation grants full system compromise including confidentiality, integrity, and availability impacts, potentially affecting all data and users within the OpenEMR instance.

Detection

Look for HTTP requests to interface/esign/index.php with module parameters containing path traversal sequences (e.g., ../../) followed by Controller.php, and concurrent POST requests to the fax upload endpoint with filenames ending in .php or lacking expected extensions; also monitor for unexpected PHP files appearing in predictable temp directories used by the fax module.

Prioritized remediation

Upgrade to OpenEMR version 8.4.0 or later, which patches the unsanitized module parameter handling in library/ESign/Router.php and enforces extension validation in the fax module's file upload functionality.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.