CVE-2026-124446High· 8.8▾ TwilightOpenEMR before 8.3.0 contains a path traversal vulnerability in the FaxSMS module's RCFaxClient and SignalWireClient disposeDocument functions that allows authenticated low-privilege users to read and overwrite arbitrary files via the un…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
OpenEMR before 8.3.0 contains a path traversal vulnerability in the FaxSMS module's RCFaxClient and SignalWireClient disposeDocument functions that allows authenticated low-privilege users to read and overwrite arbitrary files via the unsanitized file_path parameter. Attackers can request action=download to retrieve cleartext files like sqlconf.php database credentials and keys, or use action=setup to overwrite web-server-writable files with ciphertext.
openemr < 8.3.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-124450Critical· 9.9OpenEMR before 8.3.0 Arbitrary File Read/Write via disposeDocument
CVE-2026-124479Medium· 6.5OpenEMR before 8.4.0 Arbitrary File Read via REST Document Download
CVE-2026-124490Critical· 9.1OpenEMR before 8.3.0 Arbitrary File Read/Write via oe-module-faxsms disposeDocument
CVE-2026-124445Critical· 9.8OpenEMR 7.0.1 before 8.4.0 OneTimeAuth Token Replay and PIN Brute Force
CVE-2026-124444High· 7.1OpenEMR before 8.4.0 SQL Injection via OnsiteDocument Query API
CVE-2026-124456High· 7.1OpenEMR before 8.3.0 Missing Authorization and IDOR in Prior-Authorizations Module