CVE-2026-124450 · Other
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.3.0 fails to validate a file path in the fax/sms module's disposeDocument action. An authenticated low-privilege user can read sqlconf.php to get database credentials and write arbitrary files as the web user, which enables remote code execution.
first public Aug 18, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
OpenEMR instances before 8.3.0 with the fax/sms module reachable by logged-in users. Any user with a low-privilege account can reach the vulnerable action, so the risk is highest where many staff or patients hold accounts. Installations already on 8.3.0 or later are not affected.
Not affected if fax-sms-module-disabled, openemr-8.3.0-or-later
Who cares healthcare, openemr, php, self-hosted
8.3.0 are in range.8.3.0 or laterOpenEMR before 8.3.0 contains a broken access control and path traversal vulnerability in the fax/sms module disposeDocument action via an unvalidated file_path parameter. Authenticated low-privilege users can read sqlconf.php to recover database credentials and write arbitrary files as the web user, enabling remote code execution.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.