CVE-2026-124446

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.3.0

Description An issue exists in the FaxSMS module's disposeDocument() functions within RCFaxClient and SignalWireClient. Authenticated users with low privileges can perform path traversal—a method used to access files and directories that are stored outside the web root folder—by manipulating the unsanitized file path parameter. By requesting action=download, an attacker can retrieve sensitive cleartext files, such as sqlconf.php containing database credentials and keys. Alternatively, using action=setup allows the overwriting of files writable by the web server with ciphertext.

Recommendations Update to version 8.3.0 or later. As a temporary mitigation, restrict access to the FaxSMS module functions disposeDocument() in RCFaxClient and SignalWireClient.