CVE-2026-126490: OpenEMR before 8.5.0 Information Disclosure via Debug Code in fax_view.php
OpenEMR before 8.5.0 contains active debug code in interface/fax/faxview.php that executes passthru("groups") and discloses the web server's Unix group memberships. Authenticated attackers with fax module access can supply a nonexistent jid value to reveal groups such as adm or shadow, aiding privilege escalation planning.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and have access to the OpenEMR fax module. The attack also requires supplying a nonexistent jid value.
What information is exposed?
The vulnerable debug code runs the Unix groups command and returns the web server process's group memberships. Exposed groups may include sensitive memberships such as adm or shadow, which can help with privilege-escalation planning.
Is this exploitable without authentication?
No. The reported attack vector requires low-level privileges, specifically authenticated access to the fax module.
What should be done if upgrading is not immediately possible?
Restrict access to the fax module to only necessary authenticated users, since fax-module access is required for exploitation. Monitor requests involving nonexistent jid values as a potential indicator of probing.