CVE-2026-124490 OpenEMR before 8.3.0 Arbitrary File Read/Write via oe-module-faxsms disposeDocument
CriticalCVSS 9.4
- Published
- Updated
- Exploit status
- No public exploit known
Description
OpenEMR before 8.3.0 contains a path traversal vulnerability in the RingCentral RCFaxClient disposeDocument() method of oe-module-faxsms that allows authenticated attackers to read and write arbitrary files via the file_path parameter. Attackers can use action=download to read credentials and source code, or action=setup with base64 content to write web-executable files for code execution.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openemr | < 8.3.0 | 8.3.0 |
References
- GitHub Security Advisory (GHSA-38jw-pwgq-9hpj) vendor-advisory
- VulnCheck Advisory: OpenEMR before 8.3.0 Arbitrary File Read/Write via oe-module-faxsms disposeDocument third-party-advisory