{"id":"CVE-2026-124446","published":"2026-11-08T14:18:11.650","lastModified":"2026-11-10T21:46:24.857","description":"OpenEMR before 8.3.0 contains a path traversal vulnerability in the FaxSMS module's RCFaxClient and SignalWireClient disposeDocument functions that allows authenticated low-privilege users to read and overwrite arbitrary files via the unsanitized file_path parameter. Attackers can request action=download to retrieve cleartext files like sqlconf.php database credentials and keys, or use action=setup to overwrite web-server-writable files with ciphertext.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-73"],"vendors":[],"products":[],"references":[{"url":"https://github.com/openemr/openemr/security/advisories/GHSA-x2vr-jgg8-c57c","tags":[]},{"url":"https://www.vulncheck.com/advisories/openemr-before-8.3.0-arbitrary-file-read-and-write-via-faxsms-disposedocument","tags":[]}],"exploitRefs":[{"url":"https://github.com/openemr/openemr/security/advisories/GHSA-x2vr-jgg8-c57c","tags":[]}],"hasPoc":true,"ai":{"summary":"OpenEMR before 8.3.0 has a path traversal flaw in its FaxSMS module where unsanitized 'file_path' parameters allow authenticated low-privilege users to read or overwrite arbitrary files on the server. This enables theft of sensitive credentials (e.g., from sqlconf.php) or injection of malicious code via file overwrites.","exploitability":"Exploitation requires valid low-privilege authentication and is straightforward due to lack of input sanitization on the file_path parameter in action=download or action=setup endpoints.","blast_radius":"Successful exploitation could lead to full system compromise via credential theft, webshell deployment, or data destruction, affecting confidentiality, integrity, and availability simultaneously.","remediation":"Upgrade to OpenEMR version 8.3.0 or later, which patches the path traversal vulnerability in the FaxSMS module's disposeDocument functions.","detection":"Defenders should monitor web server access logs for requests to /interface/fax/RCFaxClient.php or SignalWireClient.php with suspicious file_path parameters containing '../' sequences or non-expected paths (e.g., '../../sites/default/sqlconf.php'), especially when paired with action=download or action=setup parameters.","tags":["path-traversal","authentication-bypass","credential-theft","webapp","openemr"],"model":"garnet-coder","analyzedAt":"2026-11-09T09:46:11.616Z"}}