CVE-2026-124450 is a critical broken access control and path traversal flaw in OpenEMR before 8.3.0 that lets authenticated low-privilege users read database credentials and write arbitrary files, enabling remote code execution.
What Is It
The vulnerability is in the disposeDocument action of OpenEMR's fax/sms module. The action accepts a file_path parameter without validating it, so an attacker controls which file path the server reads from or writes to. The weakness is classified as CWE-73 (External Control of File Name or Path).
An authenticated user with low privileges can abuse this to:
- Read
sqlconf.phpand recover the application's database credentials - Write arbitrary files as the web server user, which enables remote code execution
VulnCheck disclosed the issue, and NVD published it on 2026-11-08. The NVD record is currently in "Received" status.
Why It Matters
VulnCheck scores this flaw 9.9 CRITICAL under CVSS 3.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L) and 9.3 CRITICAL under CVSS 4.0. The vector shows:
- Network-reachable, low attack complexity
- Only low privileges required, no user interaction
- Changed scope, with high confidentiality and integrity impact
In practice, any valid low-privilege account can lead to full compromise of the application. Once an attacker has the database credentials, the data behind the application is exposed. Arbitrary file writes give the attacker code execution on the host. OpenEMR is an electronic medical records platform, so affected deployments are likely to hold sensitive patient data.
The CISA KEV entry supplied for this brief is empty. KEV does not currently confirm active exploitation, and the supplied sources do not report any in-the-wild exploitation.
What's Vulnerable
- Vendor/Product: OpenEMR
- Affected: all versions before 8.3.0
- Unaffected: 8.3.0
The record does not list any affected CPEs.
Patch Status
According to the affected-version data, OpenEMR 8.3.0 is not vulnerable. Organizations running earlier versions should upgrade to 8.3.0 or later. Review the vendor's GitHub security advisory for full remediation guidance. CISA has issued no KEV required action or due date, because the supplied data contains no KEV listing.