CVE-2026-124490

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.3.0

Description A path traversal issue exists in the disposeDocument() function of the RingCentral RCFaxClient within the oe-module-faxsms module. Authenticated attackers can read and write arbitrary files by manipulating the file path parameter. By using action=download, an attacker can access credentials and source code. Alternatively, using action=setup with base64 encoded content allows the creation of web-executable files, which can lead to remote code execution.

Recommendations Update to version 8.3.0 or later. Restrict access to the disposeDocument() function within the oe-module-faxsms module as a temporary mitigation.