CVE-2026-65983 · Package
NO FIX YET · SEE WHAT TO DO
OpenEMR's fax/SMS module decrypts patient documents and stores them as plaintext files under a public web path, never deleting them. Anyone who obtains or guesses the URL can read persistent patient records, even when drive encryption is on.
first public Jul 15, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Clinics and practices that run self-hosted OpenEMR with the faxsms custom module enabled and use SignalWire for faxing. The exposure depends on the public URL of staged fax files; installations without the module, or on versions 8.2.0 and later, are not affected.
Not affected if faxsms-module-disabled, no-signalwire-fax, version-8.2.0-or-later
Who cares healthcare, openemr, php, self-hosted
8.2.0.oe-module-faxsms module under interface/modules/custom_modules/ and check whether it is enabled.sites/{siteId}/fax that are reachable over HTTP.8.2.0 or later.OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.2.0, interface/modules/custom_modules/oe-module-faxsms/src/Controller/SignalWireClient.php decrypts a selected patient document with Document::get_data() and SignalWireClient::uploadFileForFax() writes the plaintext bytes under sites/{siteId}/fax. The module returns the resulting public URL to SignalWire, protects it only with a predictable uniqid() filename, and never removes the staged file. An unauthenticated network actor who obtains or guesses the URL can retrieve persistent patient documents even when drive encryption is enabled. This issue is fixed in version 8.2.0.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.