{"id":"CVE-2026-124450","published":"2026-11-08T14:18:12.260","lastModified":"2026-11-10T21:46:29.607","description":"OpenEMR before 8.3.0 contains a broken access control and path traversal vulnerability in the fax/sms module disposeDocument action via an unvalidated file_path parameter. Authenticated low-privilege users can read sqlconf.php to recover database credentials and write arbitrary files as the web user, enabling remote code execution.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","cwes":["CWE-73"],"vendors":[],"products":[],"references":[{"url":"https://github.com/openemr/openemr/security/advisories/GHSA-wf4w-mx2w-j4vv","tags":[]},{"url":"https://www.vulncheck.com/advisories/openemr-before-8.3.0-arbitrary-file-read-write-via-disposedocument","tags":[]}],"exploitRefs":[{"url":"https://github.com/openemr/openemr/security/advisories/GHSA-wf4w-mx2w-j4vv","tags":[]}],"hasPoc":true,"ai":{"summary":"OpenEMR before 8.3.0 has broken access control and path traversal in the fax/sms module's disposeDocument action due to insufficient validation of the file_path parameter. Authenticated low-privilege users can read sensitive files like sqlconf.php to steal database credentials and write arbitrary files as the web server user, leading to remote code execution.","exploitability":"Exploitation requires only valid low-privilege authentication and is straightforward due to lack of input sanitization and access checks on a public-facing endpoint.","blast_radius":"Successful exploitation grants attackers database credentials and the ability to execute arbitrary code on the server, potentially compromising all data and systems accessible to the web server user.","remediation":"Upgrade to OpenEMR version 8.3.0 or later, which patches the access control and path traversal flaws in the fax/sms module.","detection":"Defenders should monitor for HTTP requests to /fax/sms/disposeDocument.php with file_path parameters containing directory traversal sequences (e.g., ../../) or attempts to read sensitive files like sqlconf.php; such requests from low-privilege users are anomalous and indicate exploitation attempts.","tags":["path-traversal","auth-bypass","rce","web","credential-theft"],"model":"garnet-coder","analyzedAt":"2026-11-09T09:42:02.819Z"}}