Advisory · CVE-2026-124450
OpenEMR fax module flaw lets low-privilege users read database credentials and run code
OpenEMR before 8.3.0 contains broken access control and path traversal in the fax/sms module disposeDocument action via an unvalidated file_path parameter, letting authenticated low-privilege users read sqlconf.php to recover database credentials and write arbitrary files as the web user, enabling remote code execution, rated critical at CVSS 9.9; fixed in 8.3.0.
- Vendor
- OpenEMR
- Product
- OpenEMR
- Identifier / CWE
- CVE-2026-124450
CWE-73 - Action timing
- Immediate
Explain it like I’m five
OpenEMR has a fax feature that throws documents away, and it trusts the file name it is handed. A low-privilege user can hand it a crafted name that points at the database password file, read it, and then write their own files onto the server to run code.
- 01Low-privilege login
An authenticated low-privilege user reaches the fax/sms module.
- 02Crafted file path
A disposeDocument request carries an unvalidated file_path parameter.
- 03Credentials read
The path traversal reads sqlconf.php, recovering database credentials.
- 04Arbitrary file written
The same parameter writes attacker-chosen files as the web user.
- 05Code executed
A written file runs on the server, giving remote code execution.
What happened
OpenEMR before 8.3.0 contains a broken access control and path traversal vulnerability in the fax/sms module disposeDocument action via an unvalidated file_path parameter. Authenticated low-privilege users can read sqlconf.php to recover database credentials and write arbitrary files as the web user, enabling remote code execution. The record rates it critical at CVSS 9.9 under version 3.1, with network attack vector, low complexity, low privileges required, and no user interaction.
Database credentials plus file write as the web user is a full server compromise from a low-privilege account. The flaw is fixed in OpenEMR 8.3.0.
What to do
- Inventory OpenEMR deployments and record each version.
- Upgrade to OpenEMR 8.3.0 or later.
- Rotate database credentials and any secrets stored in sqlconf.php.
- Review web server file writes and fax module logs for traversal attempts.
- Treat the database as potentially accessed and audit for unexpected reads or changes.
- Verify the deployed version after updating.
Management note
Low-privilege to database credentials to remote code execution is the worst path in this batch. Rotate the database credentials as part of the fix, not after it.