{"id":"CVE-2026-65983","kind":"vulnerability","aliases":["CVE-2026-65983"],"related":[],"title":"OpenEMR: fax module leaves decrypted patient documents guessable on the web","description":"OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.2.0, interface/modules/custom_modules/oe-module-faxsms/src/Controller/SignalWireClient.php decrypts a selected patient document with Document::get_data() and SignalWireClient::uploadFileForFax() writes the plaintext bytes under sites/{siteId}/fax. The module returns the resulting public URL to SignalWire, protects it only with a predictable uniqid() filename, and never removes the staged file. An unauthenticated network actor who obtains or guesses the URL can retrieve persistent patient documents even when drive encryption is enabled. This issue is fixed in version 8.2.0.","summary":"OpenEMR's fax/SMS module decrypts patient documents and stores them as plaintext files under a public web path, never deleting them. Anyone who obtains or guesses the URL can read persistent patient records, even when drive encryption is on.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","package","php","self-hosted"],"not_affected_if":["faxsms-module-disabled","no-signalwire-fax","version-8.2.0-or-later"],"how_to_check":"- Check the OpenEMR version in the installation; affected versions are those before `8.2.0`.\n- Look for the `oe-module-faxsms` module under `interface/modules/custom_modules/` and check whether it is enabled.\n- Look for files under `sites/{siteId}/fax` that are reachable over HTTP.","fix":"- OpenEMR: move to `8.2.0` or later.","status":"open","published_at":"2026-11-05T20:17:59+00:00","first_seen_at":"2026-11-05T20:40:46+00:00","triaged_at":"2026-11-05T20:43:00+00:00","updated_at":"2026-11-05T20:43:00+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-05T20:43:00Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: move to `8.2.0` or later.","reach":"internet","title":"OpenEMR: fax module leaves decrypted patient documents guessable on the web","impact":"high","summary":"OpenEMR's fax/SMS module decrypts patient documents and stores them as plaintext files under a public web path, never deleting them. Anyone who obtains or guesses the URL can read persistent patient records, even when drive encryption is on.","audience":"businesses","category":"package","nicknames":[],"who_cares":["openemr","healthcare","self-hosted","php"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated attackers read persistent patient documents over HTTP","analyst_note":"","how_to_check":"- Check the OpenEMR version in the installation; affected versions are those before `8.2.0`.\n- Look for the `oe-module-faxsms` module under `interface/modules/custom_modules/` and check whether it is enabled.\n- Look for files under `sites/{siteId}/fax` that are reachable over HTTP.","plain_action":"","needs_analyst":false,"not_affected_if":["version-8.2.0-or-later","faxsms-module-disabled","no-signalwire-fax"],"who_is_affected":"Clinics and practices that run self-hosted OpenEMR with the faxsms custom module enabled and use SignalWire for faxing. The exposure depends on the public URL of staged fax files; installations without the module, or on versions 8.2.0 and later, are not affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000723,"input_tokens":4390,"output_tokens":569,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-65983':14A,17A '/fax':100C '8.2.0':79C,151C 'actor':127C 'anyon':46B 'applic':76C 'byte':96C 'cve':12A,15A 'data':89C 'decrypt':5A,29B,81C 'delet':44B 'document':7A,31B,85C,87C,138C 'drive':60B,141C 'electron':69C 'enabl':144C 'encrypt':61B,142C 'even':58B,139C 'fax':2A 'fax/sms':27B 'file':37B,123C 'filenam':117C 'fix':148C 'free':65C 'get':88C 'guess':50B,131C 'guessabl':8A 'health':70C 'healthcar':18B 'host':24B 'interface/modules/custom_modules/oe-module-faxsms/src/controller/signalwireclient.php':80C 'issu':146C 'leav':4A 'manag':75C 'medic':73C 'modul':3A,28B,102C 'network':126C 'never':43B,119C 'obtain':48B,129C 'open':67C 'openemr':1A,19B,25B,62C 'packag':20B 'path':42B 'patient':6A,30B,56B,84C,137C 'persist':55B,136C 'php':21B 'plaintext':36B,95C 'practic':74C 'predict':115C 'prior':77C 'protect':110C 'public':40B,106C 'read':54B 'record':57B,71C 'remov':120C 'result':105C 'retriev':135C 'return':103C 'select':83C 'self':23B 'self-host':22B 'signalwir':109C 'signalwirecli':91C 'site':98C 'siteid':99C 'sourc':68C 'stage':122C 'store':33B 'unauthent':125C 'uniqid':116C 'uploadfileforfax':92C 'url':52B,107C,133C 'version':150C 'web':11A,41B 'write':93C","nicknames":[],"mitigations":[],"who_affected":"Clinics and practices that run self-hosted OpenEMR with the faxsms custom module enabled and use SignalWire for faxing. The exposure depends on the public URL of staged fax files; installations without the module, or on versions 8.2.0 and later, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","high","openemr","package","php","selfhosted"],"campaign_type":null,"first_public_at":"2026-07-15T01:34:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-65983","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65983","severity":null,"published_at":"2026-11-05T20:17:59+00:00","modified_at":"2026-11-05T20:17:59+00:00","first_seen_at":"2026-11-05T20:40:46+00:00","fetched_at":"2026-11-05T20:40:46+00:00","note":null}],"documents":[{"id":79894,"url":"https://github.com/openemr/openemr/commit/406bb7015e894c243936b0817d7c7060686a13d9","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79895,"url":"https://github.com/openemr/openemr/releases/tag/v8_2_0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79896,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-vv5j-6gjw-ffx9","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-15T01:34:11+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}