CVE-2026-124450: OpenEMR before 8.3.0 Arbitrary File Read/Write via disposeDocument

Published Nov 8, 2026

Updated

OpenEMR before 8.3.0 contains a broken access control and path traversal vulnerability in the fax/sms module disposeDocument action via an unvalidated filepath parameter. Authenticated low-privilege users can read sqlconf.php to recover database credentials and write arbitrary files as the web user, enabling remote code execution.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade OpenEMR to a version that resolves this vulnerability.
Fixed in 8.3.0

Event History

Nov 8, 2026

CVE Published

via MITRE·01:15 PM

Data Sourced

via MITRE·01:15 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need?

An attacker needs an authenticated low-privilege OpenEMR account. No user interaction is required.

What can an attacker do after exploiting the issue?

They can read files such as sqlconf.php to obtain database credentials and write arbitrary files as the web user. The arbitrary file write can enable remote code execution.

Which deployments are affected?

OpenEMR versions before 8.3.0 are affected. The issue is in the fax/sms module's disposeDocument action and relies on an unvalidated file_path parameter.

CVE-2026-124450: OpenEMR before 8.3.0 Arbitrary File Read/Write via disposeDocument

Remediation

Event History

Frequently Asked Questions

What level of access does an attacker need?

What can an attacker do after exploiting the issue?

Which deployments are affected?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need?

What can an attacker do after exploiting the issue?

Which deployments are affected?