Act nowDisclosed

Advisory · CVE-2026-124490

OpenEMR fax integration flaw reads credentials and writes web-executable files

OpenEMR before 8.3.0 contains path traversal in the RingCentral RCFaxClient disposeDocument method of oe-module-faxsms, letting authenticated attackers read and write arbitrary files via the file_path parameter, using action download to read credentials and source code or action setup with base64 content to write web-executable files for code execution, rated critical at CVSS 9.1; fixed in 8.3.0.

Advisory published November 8, 2026Independent summary
Vendor
OpenEMR
Product
OpenEMR
Identifier / CWE
CVE-2026-124490
CWE-73
Action timing
Immediate
ELI5

Explain it like I’m five

OpenEMR's RingCentral fax add-on throws documents away by file name, and it never checks the name. An attacker can point it at the password file to read it, or hand it a file of their own to plant on the server and run.

SIMPLIFIED_ATTACK_PATH05 STEPS
  1. 01Authenticated access

    An attacker logs in with any authenticated account.

  2. 02Crafted file path

    A disposeDocument request carries a traversal in file_path.

  3. 03Download reads files

    action=download returns credentials and source code.

  4. 04Setup writes files

    action=setup writes base64 content to a web-executable location.

  5. 05Code executed

    The planted file runs on the server.

What happened

OpenEMR before 8.3.0 contains a path traversal vulnerability in the RingCentral RCFaxClient disposeDocument() method of oe-module-faxsms that allows authenticated attackers to read and write arbitrary files via the file_path parameter. Attackers can use action=download to read credentials and source code, or action=setup with base64 content to write web-executable files for code execution. The record rates it critical at CVSS 9.1 under version 3.1, with network attack vector, low complexity, high privileges required, and no user interaction.

The same fax disposal pattern appears in more than one OpenEMR flaw in this batch, and this instance reaches web-executable writes. The flaw is fixed in OpenEMR 8.3.0.

What to do

  1. Inventory OpenEMR deployments and record each version.
  2. Upgrade to OpenEMR 8.3.0 or later.
  3. Rotate database credentials and any secrets readable from the web root.
  4. Review fax module logs and the web root for planted files.
  5. Treat the server as potentially compromised if unknown files are found.
  6. Verify the deployed version after updating.

Management note

A fax add-on that can plant runnable files on the server is a full compromise path. Check the web root for files that should not be there.