{"id":"CVE-2026-124446","kind":"vulnerability","aliases":["CVE-2026-124446"],"related":[],"title":"OpenEMR: FaxSMS module lets logged-in users read and overwrite server files","description":"OpenEMR before 8.3.0 contains a path traversal vulnerability in the FaxSMS module's RCFaxClient and SignalWireClient disposeDocument functions that allows authenticated low-privilege users to read and overwrite arbitrary files via the unsanitized file_path parameter. Attackers can request action=download to retrieve cleartext files like sqlconf.php database credentials and keys, or use action=setup to overwrite web-server-writable files with ciphertext.","summary":"OpenEMR's FaxSMS module fails to sanitize the file_path parameter in its RCFaxClient and SignalWireClient disposeDocument functions, which is a path traversal flaw. An authenticated low-privilege user can download arbitrary files, including sqlconf.php with database credentials, or overwrite web-server-writable files.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","package","php","self-hosted"],"not_affected_if":["faxsms-module-disabled","version-8.3.0-or-later"],"how_to_check":"- Check the OpenEMR version in the deployed installation; versions before `8.3.0` are affected.\n- Confirm whether the FaxSMS module is enabled and uses RCFaxClient or SignalWireClient.","fix":"- OpenEMR: move to `8.3.0` or later.","status":"open","published_at":"2026-11-08T14:18:11+00:00","first_seen_at":"2026-11-08T14:48:39+00:00","triaged_at":"2026-11-08T14:49:01+00:00","updated_at":"2026-11-08T14:49:01+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-08T14:49:01Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: move to `8.3.0` or later.","reach":"network","title":"OpenEMR: FaxSMS module lets logged-in users read and overwrite server files","impact":"high","summary":"OpenEMR's FaxSMS module fails to sanitize the file_path parameter in its RCFaxClient and SignalWireClient disposeDocument functions, which is a path traversal flaw. An authenticated low-privilege user can download arbitrary files, including sqlconf.php with database credentials, or overwrite web-server-writable files.","audience":"businesses","category":"package","nicknames":[],"who_cares":["openemr","healthcare","self-hosted","php"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"attacker reads database credentials and overwrites server files","analyst_note":"","how_to_check":"- Check the OpenEMR version in the deployed installation; versions before `8.3.0` are affected.\n- Confirm whether the FaxSMS module is enabled and uses RCFaxClient or SignalWireClient.\n- unknown","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-8.3.0-or-later","faxsms-module-disabled"],"who_is_affected":"OpenEMR installations before 8.3.0 that have the FaxSMS module in use with RCFaxClient or SignalWireClient. Exposure needs a logged-in account, though the description says low-privilege users are enough. Sites on a later version can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000746,"input_tokens":4665,"output_tokens":559,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124446':16A,19A '-2026':15A,18A '8.3.0':75C 'action':113C,127C 'allow':92C 'arbitrari':59B,102C 'attack':110C 'authent':52B,93C 'ciphertext':137C 'cleartext':117C 'contain':76C 'credenti':65B,122C 'cve':14A,17A 'databas':64B,121C 'disposedocu':43B,89C 'download':58B,114C 'fail':31B 'faxsm':2A,29B,83C 'file':13A,35B,60B,72B,103C,107C,118C,135C 'flaw':50B 'function':44B,90C 'healthcar':20B 'host':26B 'includ':61B 'key':124C 'let':4A 'like':119C 'log':6A 'logged-in':5A 'low':54B,95C 'low-privileg':53B,94C 'modul':3A,30B,84C 'openemr':1A,21B,27B,73C 'overwrit':11A,67B,101C,130C 'packag':22B 'paramet':37B,109C 'path':36B,48B,78C,108C 'php':23B 'privileg':55B,96C 'rcfaxclient':40B,86C 'read':9A,99C 'request':112C 'retriev':116C 'sanit':33B 'self':25B 'self-host':24B 'server':12A,70B,133C 'setup':128C 'signalwirecli':42B,88C 'sqlconf.php':62B,120C 'travers':49B,79C 'unsanit':106C 'use':126C 'user':8A,56B,97C 'via':104C 'vulner':80C 'web':69B,132C 'web-server-writ':68B,131C 'writabl':71B,134C","nicknames":[],"mitigations":[],"who_affected":"OpenEMR installations before 8.3.0 that have the FaxSMS module in use with RCFaxClient or SignalWireClient. Exposure needs a logged-in account, though the description says low-privilege users are enough. Sites on a later version can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","high","openemr","package","php","selfhosted"],"campaign_type":null,"search_a":"'-124446':16A,19A '-2026':15A,18A 'cve':14A,17A 'faxsm':2A 'file':13A 'let':4A 'log':6A 'logged-in':5A 'modul':3A 'openemr':1A 'overwrit':11A 'read':9A 'server':12A 'user':8A","search_b":"'arbitrari':59B 'authent':52B 'credenti':65B 'databas':64B 'disposedocu':43B 'download':58B 'fail':31B 'faxsm':29B 'file':35B,60B,72B 'flaw':50B 'function':44B 'healthcar':20B 'host':26B 'includ':61B 'low':54B 'low-privileg':53B 'modul':30B 'openemr':21B,27B 'overwrit':67B 'packag':22B 'paramet':37B 'path':36B,48B 'php':23B 'privileg':55B 'rcfaxclient':40B 'sanit':33B 'self':25B 'self-host':24B 'server':70B 'signalwirecli':42B 'sqlconf.php':62B 'travers':49B 'user':56B 'web':69B 'web-server-writ':68B 'writabl':71B","search_c":"'8.3.0':75C 'action':113C,127C 'allow':92C 'arbitrari':102C 'attack':110C 'authent':93C 'ciphertext':137C 'cleartext':117C 'contain':76C 'credenti':122C 'databas':121C 'disposedocu':89C 'download':114C 'faxsm':83C 'file':103C,107C,118C,135C 'function':90C 'key':124C 'like':119C 'low':95C 'low-privileg':94C 'modul':84C 'openemr':73C 'overwrit':101C,130C 'paramet':109C 'path':78C,108C 'privileg':96C 'rcfaxclient':86C 'read':99C 'request':112C 'retriev':116C 'server':133C 'setup':128C 'signalwirecli':88C 'sqlconf.php':120C 'travers':79C 'unsanit':106C 'use':126C 'user':97C 'via':104C 'vulner':80C 'web':132C 'web-server-writ':131C 'writabl':134C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-08-18T08:40:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124446","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124446","severity":null,"published_at":"2026-11-08T14:18:11+00:00","modified_at":"2026-11-08T14:18:11+00:00","first_seen_at":"2026-11-08T14:48:39+00:00","fetched_at":"2026-11-08T14:48:39+00:00","note":null}],"documents":[{"id":102076,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-x2vr-jgg8-c57c","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-08-18T08:40:58+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":102077,"url":"https://www.vulncheck.com/advisories/openemr-before-8.3.0-arbitrary-file-read-and-write-via-faxsms-disposedocument","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}