CVE-2026-24849: OpenEMR Arbitrary File Read Vulnerability
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 7.0.4, the disposeDocument() method in EtherFaxActions.php allows authenticated users to read arbitrary files from the server filesystem. Any authenticated user (regardless of privilege level) can exploit this vulnerability to read sensitive files. Version 7.0.4 patches the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenEMRto a version that resolves this vulnerability.Fixed in 7.0.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24849?
CVE-2026-24849 is categorized as a high severity vulnerability due to the potential for arbitrary file reading from the server.
How do I fix CVE-2026-24849?
To fix CVE-2026-24849, upgrade OpenEMR to version 7.0.4 or later to eliminate the vulnerability.
Who is affected by CVE-2026-24849?
CVE-2026-24849 affects all users of OpenEMR versions prior to 7.0.4 who have authenticated access.
What is the nature of the vulnerability in CVE-2026-24849?
CVE-2026-24849 is an arbitrary file read vulnerability that allows authenticated users to access sensitive files on the server.
Is CVE-2026-24849 easy to exploit?
Yes, CVE-2026-24849 can potentially be easily exploited by authenticated users with minimal technical skill.