---
id: "CVE-2026-65983"
kind: "vulnerability"
aliases: ["CVE-2026-65983"]
title: "OpenEMR: fax module leaves decrypted patient documents guessable on the web"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["healthcare", "openemr", "package", "php", "self-hosted"]
not_affected_if: ["faxsms-module-disabled", "no-signalwire-fax", "version-8.2.0-or-later"]
published_at: "2026-11-05T20:17:59+00:00"
first_seen_at: "2026-11-05T20:40:46+00:00"
updated_at: "2026-11-05T20:43:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65983", "first_seen_at": "2026-11-05T20:40:46+00:00"}]
exploit_sources: []
---

# OpenEMR: fax module leaves decrypted patient documents guessable on the web

OpenEMR's fax/SMS module decrypts patient documents and stores them as plaintext files under a public web path, never deleting them. Anyone who obtains or guesses the URL can read persistent patient records, even when drive encryption is on.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the OpenEMR version in the installation; affected versions are those before `8.2.0`.
- Look for the `oe-module-faxsms` module under `interface/modules/custom_modules/` and check whether it is enabled.
- Look for files under `sites/{siteId}/fax` that are reachable over HTTP.

## Fix

- OpenEMR: move to `8.2.0` or later.

## Timeline

- 2026-11-05T20:40:46+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-65983

## Documents

- [advisory] Vendor advisory: github.com https://github.com/openemr/openemr/security/advisories/GHSA-vv5j-6gjw-ffx9
- [fix] Patch: github.com https://github.com/openemr/openemr/commit/406bb7015e894c243936b0817d7c7060686a13d9
- [fix] Release notes: github.com https://github.com/openemr/openemr/releases/tag/v8_2_0

## From the sources

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.2.0, interface/modules/custom_modules/oe-module-faxsms/src/Controller/SignalWireClient.php decrypts a selected patient document with Document::get_data() and SignalWireClient::uploadFileForFax() writes the plaintext bytes under sites/{siteId}/fax. The module returns the resulting public URL to SignalWire, protects it only with a predictable uniqid() filename, and never removes the staged file. An unauthenticated network actor who obtains or guesses the URL can retrieve persistent patient documents even when drive encryption is enabled. This issue is fixed in version 8.2.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_