CVE-2026-124446 · Package
NO FIX YET · SEE WHAT TO DO
OpenEMR's FaxSMS module fails to sanitize the file_path parameter in its RCFaxClient and SignalWireClient disposeDocument functions, which is a path traversal flaw. An authenticated low-privilege user can download arbitrary files, including sqlconf.php with database credentials, or overwrite web-server-writable files.
first public Aug 18, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
OpenEMR installations before 8.3.0 that have the FaxSMS module in use with RCFaxClient or SignalWireClient. Exposure needs a logged-in account, though the description says low-privilege users are enough. Sites on a later version can skip it.
Not affected if faxsms-module-disabled, version-8.3.0-or-later
Who cares healthcare, openemr, php, self-hosted
8.3.0 are affected.8.3.0 or later.OpenEMR before 8.3.0 contains a path traversal vulnerability in the FaxSMS module's RCFaxClient and SignalWireClient disposeDocument functions that allows authenticated low-privilege users to read and overwrite arbitrary files via the unsanitized file_path parameter. Attackers can request action=download to retrieve cleartext files like sqlconf.php database credentials and keys, or use action=setup to overwrite web-server-writable files with ciphertext.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.