CVE-2026-124490

Summary

OpenEMR before 8.3.0 contains a path traversal flaw in the RingCentral RCFaxClient module's disposeDocument() method, allowing authenticated attackers to read or write arbitrary files via the file_path parameter. This enables credential theft and remote code execution by writing web-accessible malicious files.

Exploitability

Exploitation requires valid authentication and manipulation of the file_path parameter in requests to the faxsms module's download or setup endpoints.

Blast radius

Successful exploitation could lead to full system compromise, including credential theft, persistent backdoor installation, and complete compromise of the OpenEMR application and underlying server.

Detection

Defenders should monitor web server access logs for requests to /interface/modules/faxsms/ endpoints with suspicious file_path parameters containing directory traversal sequences (e.g., ../) or base64-encoded content in action=setup requests, especially when combined with non-standard file extensions or paths outside expected document roots.

Prioritized remediation

Upgrade to OpenEMR version 8.3.0 or later, which patches this path traversal vulnerability in the oe-module-faxsms component.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.