Advisory · CVE-2026-124467
OpenEMR e-signature flaw lets authenticated users run code on the server
OpenEMR before 8.4.0 contains local file inclusion in the ESign router, which passes the unsanitized module parameter into a require_once, and the fax module writes attacker-named files to a predictable temp path without extension checks, letting authenticated attackers upload a PHP file named Controller.php and include it to execute arbitrary code, rated high at CVSS 8.8; fixed in 8.4.0.
- Vendor
- OpenEMR
- Product
- OpenEMR
- Identifier / CWE
- CVE-2026-124467
CWE-22 - Action timing
- Immediate
Explain it like I’m five
OpenEMR's e-signature page loads a file based on a name in the web address, and the fax uploader saves files where an attacker can predict. Upload a file called Controller.php, then ask the signature page to load it, and the server runs it.
- 01PHP file uploaded
An authenticated attacker uploads a PHP file named Controller.php through the fax module.
- 02Predictable temp path
The file lands on a predictable temporary path without extension checks.
- 03Module parameter set
The attacker requests interface/esign/index.php with a traversing module parameter.
- 04File included
The ESign router passes the unsanitized module into a require_once of Controller.php.
- 05Code executed
The uploaded file runs on the server.
What happened
OpenEMR before 8.4.0 contains a local file inclusion in the ESign router (library/ESign/Router.php), which passes the unsanitized module parameter into a require_once of ‘/Controller.php’, and the fax module’s faxProcessUploads writes attacker-named files to a predictable temp path without extension checks. Authenticated attackers can upload a PHP file named Controller.php, then request interface/esign/index.php with a traversing module parameter to include it and execute arbitrary code. The record rates it high at CVSS 8.8 under version 3.1, with network attack vector, low complexity, low privileges required, and no user interaction.
An upload plus an include is a classic two-step code execution chain, and both halves were reachable by authenticated users. The flaw is fixed in OpenEMR 8.4.0.
What to do
- Inventory OpenEMR deployments and record each version.
- Upgrade to OpenEMR 8.4.0 or later.
- Search the upload temp paths for unexpected PHP files.
- Review eSign and fax upload logs for Controller.php uploads.
- Treat the server as potentially compromised if unknown files are found.
- Verify the deployed version after updating.
Management note
File upload plus file inclusion is a complete server compromise in two steps. Check the temp directories for files that should not be there.