CVE-2026-124490 · Runtime
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.3.0 has a path traversal flaw in the RingCentral fax client's disposeDocument() method of the oe-module-faxsms module. An authenticated user can read credentials and source code, or write web-executable files that lead to code execution on the server.
first public Aug 18, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any OpenEMR installation before 8.3.0 that has the fax/SMS module (oe-module-faxsms) involved in the RingCentral fax path is exposed, as the flaw is reachable by any authenticated account. Installations on 8.3.0 or later, or without this module, can skip it.
Not affected if module-not-installed, no-fax-integration, version-8.3.0-or-later
Who cares healthcare, openemr, php, self-hosted
8.3.0.8.3.0 or later.OpenEMR before 8.3.0 contains a path traversal vulnerability in the RingCentral RCFaxClient disposeDocument() method of oe-module-faxsms that allows authenticated attackers to read and write arbitrary files via the file_path parameter. Attackers can use action=download to read credentials and source code, or action=setup with base64 content to write web-executable files for code execution.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.