A critical path traversal flaw in OpenEMR before 8.3.0 lets authenticated attackers read and write arbitrary files through the fax/SMS module, which can lead to credential theft and code execution.
What Is It
CVE-2026-124490 is a path traversal vulnerability in the disposeDocument() method of the RingCentral RCFaxClient in OpenEMR's oe-module-faxsms module. The file_path parameter is not safely constrained, so an authenticated attacker can point it at any file on the server. The weakness is classified as CWE-73 (External Control of File Name or Path).
The flaw can be used in two ways:
- Read:
action=downloadlets an attacker read arbitrary files, including credentials and application source code. - Write:
action=setupwith base64-encoded content lets an attacker write web-executable files, which can lead to code execution on the host.
Why It Matters
VulnCheck scored the flaw CVSS 3.1 9.1 (Critical) with the vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. Its CVSS 4.0 score is 9.4 (Critical). The attack works over the network, is low-complexity and needs no user interaction. The scope is marked as changed, meaning a successful attack can affect systems beyond the vulnerable component.
The main limit is that the attacker needs high privileges. Any compromised or malicious privileged account, though, can become full code execution on the server. OpenEMR is an electronic medical records platform, so reading credentials and source code or planting executable files threatens the confidentiality and integrity of the whole deployment.
Exploitation status: The CISA Known Exploited Vulnerabilities Catalog has no entry for this CVE, so KEV does not confirm active exploitation as of this writing. The NVD record is still in "Received" status. It was published 2026-11-08.
What's Vulnerable
- Vendor/Product: OpenEMR
- Affected: All versions before 8.3.0
- Not affected: 8.3.0
- Component:
oe-module-faxsms, RingCentralRCFaxClient::disposeDocument()
Patch Status
OpenEMR 8.3.0 is listed as unaffected. Administrators running earlier versions should upgrade to 8.3.0 or later and check the vendor's GitHub security advisory for further guidance. Because the attack requires privileged authentication, also review who holds privileged OpenEMR accounts. Since CISA has not listed this CVE in KEV, it has issued no federal required action or due date.