{"id":"CVE-2026-124450","kind":"vulnerability","aliases":["CVE-2026-124450"],"related":[],"title":"OpenEMR: fax/sms module lets logged-in users read files and run code","description":"OpenEMR before 8.3.0 contains a broken access control and path traversal vulnerability in the fax/sms module disposeDocument action via an unvalidated file_path parameter. Authenticated low-privilege users can read sqlconf.php to recover database credentials and write arbitrary files as the web user, enabling remote code execution.","summary":"OpenEMR before 8.3.0 fails to validate a file path in the fax/sms module's disposeDocument action. An authenticated low-privilege user can read sqlconf.php to get database credentials and write arbitrary files as the web user, which enables remote code execution.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","other","php","self-hosted"],"not_affected_if":["fax-sms-module-disabled","openemr-8.3.0-or-later"],"how_to_check":"- Check the installed OpenEMR version in the application's version setting or package files; versions below `8.3.0` are in range.\n- Look for the fax/sms module and the disposeDocument action in the deployed code.","fix":"- OpenEMR: move to `8.3.0` or later","status":"open","published_at":"2026-11-08T14:18:12+00:00","first_seen_at":"2026-11-08T14:48:39+00:00","triaged_at":"2026-11-08T14:48:46+00:00","updated_at":"2026-11-08T14:48:46+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-08T14:48:46Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: move to `8.3.0` or later\n- unknown","reach":"network","title":"OpenEMR: fax/sms module lets logged-in users read files and run code","impact":"high","summary":"OpenEMR before 8.3.0 fails to validate a file path in the fax/sms module's disposeDocument action. An authenticated low-privilege user can read sqlconf.php to get database credentials and write arbitrary files as the web user, which enables remote code execution.","audience":"businesses","category":"other","nicknames":[],"who_cares":["openemr","healthcare","self-hosted","php"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"attacker reads database credentials and runs code on the server","analyst_note":"Confirm the affected version range and whether the fax/sms module is enabled by default, using the vendor advisory on github.com and the VulnCheck advisory.","how_to_check":"- Check the installed OpenEMR version in the application's version setting or package files; versions below `8.3.0` are in range.\n- Look for the fax/sms module and the disposeDocument action in the deployed code.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["openemr-8.3.0-or-later","fax-sms-module-disabled"],"who_is_affected":"OpenEMR instances before 8.3.0 with the fax/sms module reachable by logged-in users. Any user with a low-privilege account can reach the vulnerable action, so the risk is highest where many staff or patients hold accounts. Installations already on 8.3.0 or later are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000757,"input_tokens":4604,"output_tokens":594,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-124450':16A,19A '-2026':15A,18A '8.3.0':29B,71C 'access':75C 'action':42B,86C 'arbitrari':58B,107C 'authent':44B,93C 'broken':74C 'code':13A,67B,115C 'contain':72C 'control':76C 'credenti':55B,104C 'cve':14A,17A 'databas':54B,103C 'disposedocu':41B,85C 'enabl':65B,113C 'execut':68B,116C 'fail':30B 'fax/sms':2A,38B,83C 'file':10A,34B,59B,90C,108C 'get':53B 'healthcar':20B 'host':26B 'let':4A 'log':6A 'logged-in':5A 'low':46B,95C 'low-privileg':45B,94C 'modul':3A,39B,84C 'openemr':1A,21B,27B,69C 'paramet':92C 'path':35B,78C,91C 'php':23B 'privileg':47B,96C 'read':9A,50B,99C 'recov':102C 'remot':66B,114C 'run':12A 'self':25B 'self-host':24B 'sqlconf.php':51B,100C 'travers':79C 'unvalid':89C 'user':8A,48B,63B,97C,112C 'valid':32B 'via':87C 'vulner':80C 'web':62B,111C 'write':57B,106C","nicknames":[],"mitigations":[],"who_affected":"OpenEMR instances before 8.3.0 with the fax/sms module reachable by logged-in users. Any user with a low-privilege account can reach the vulnerable action, so the risk is highest where many staff or patients hold accounts. Installations already on 8.3.0 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","healthcare","openemr","other","php","selfhosted"],"campaign_type":null,"search_a":"'-124450':16A,19A '-2026':15A,18A 'code':13A 'cve':14A,17A 'fax/sms':2A 'file':10A 'let':4A 'log':6A 'logged-in':5A 'modul':3A 'openemr':1A 'read':9A 'run':12A 'user':8A","search_b":"'8.3.0':29B 'action':42B 'arbitrari':58B 'authent':44B 'code':67B 'credenti':55B 'databas':54B 'disposedocu':41B 'enabl':65B 'execut':68B 'fail':30B 'fax/sms':38B 'file':34B,59B 'get':53B 'healthcar':20B 'host':26B 'low':46B 'low-privileg':45B 'modul':39B 'openemr':21B,27B 'path':35B 'php':23B 'privileg':47B 'read':50B 'remot':66B 'self':25B 'self-host':24B 'sqlconf.php':51B 'user':48B,63B 'valid':32B 'web':62B 'write':57B","search_c":"'8.3.0':71C 'access':75C 'action':86C 'arbitrari':107C 'authent':93C 'broken':74C 'code':115C 'contain':72C 'control':76C 'credenti':104C 'databas':103C 'disposedocu':85C 'enabl':113C 'execut':116C 'fax/sms':83C 'file':90C,108C 'low':95C 'low-privileg':94C 'modul':84C 'openemr':69C 'paramet':92C 'path':78C,91C 'privileg':96C 'read':99C 'recov':102C 'remot':114C 'sqlconf.php':100C 'travers':79C 'unvalid':89C 'user':97C,112C 'via':87C 'vulner':80C 'web':111C 'write':106C","cause_entry":null,"cause_path":null,"first_public_at":"2026-08-18T08:39:38+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124450","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124450","severity":null,"published_at":"2026-11-08T14:18:12+00:00","modified_at":"2026-11-08T14:18:12+00:00","first_seen_at":"2026-11-08T14:48:39+00:00","fetched_at":"2026-11-08T14:48:39+00:00","note":null}],"documents":[{"id":102085,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-wf4w-mx2w-j4vv","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-08-18T08:39:38+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":102086,"url":"https://www.vulncheck.com/advisories/openemr-before-8.3.0-arbitrary-file-read-write-via-disposedocument","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}