High priorityDisclosed

Advisory · CVE-2026-124446

OpenEMR fax clients let low-privilege users steal database credentials

OpenEMR before 8.3.0 contains path traversal in the FaxSMS module RCFaxClient and SignalWireClient disposeDocument functions, letting authenticated low-privilege users read and overwrite arbitrary files via the unsanitized file_path parameter, retrieving cleartext files like sqlconf.php database credentials and keys or overwriting web-server-writable files with ciphertext, rated high at CVSS 8.8; fixed in 8.3.0.

Advisory published November 8, 2026Independent summary
Vendor
OpenEMR
Product
OpenEMR
Identifier / CWE
CVE-2026-124446
CWE-73
Action timing
Immediate
ELI5

Explain it like I’m five

OpenEMR's fax clients throw documents away by file name without checking it. A low-privilege user can point that name at the database password file and read it, or overwrite files the web server can write.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Low-privilege login

    An authenticated low-privilege user reaches the FaxSMS module.

  2. 02Crafted file path

    A disposeDocument request carries an unsanitized file_path.

  3. 03Download reads secrets

    action=download returns sqlconf.php database credentials and keys.

  4. 04Setup overwrites files

    action=setup overwrites web-server-writable files with ciphertext.

What happened

OpenEMR before 8.3.0 contains a path traversal vulnerability in the FaxSMS module’s RCFaxClient and SignalWireClient disposeDocument functions that allows authenticated low-privilege users to read and overwrite arbitrary files via the unsanitized file_path parameter. Attackers can request action=download to retrieve cleartext files like sqlconf.php database credentials and keys, or use action=setup to overwrite web-server-writable files with ciphertext. The record rates it high at CVSS 8.8 under version 3.1, with network attack vector, low complexity, low privileges required, and no user interaction.

This is one of several fax disposal flaws in this OpenEMR batch, all sharing the same unvalidated file_path pattern. The flaw is fixed in OpenEMR 8.3.0.

What to do

  1. Inventory OpenEMR deployments and record each version.
  2. Upgrade to OpenEMR 8.3.0 or later.
  3. Rotate database credentials and keys stored in sqlconf.php.
  4. Review fax module logs for traversal attempts.
  5. Check web-server-writable files for unexpected changes.
  6. Verify the deployed version after updating.

Management note

Three fax flaws in one batch means the module needs the upgrade, not a workaround. Rotate the database credentials as part of the fix.