CVE-2026-65983: OpenEMR FaxSMS module: insecure staging of decrypted patient documents in webroot
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.2.0, interface/modules/custommodules/oe-module-faxsms/src/Controller/SignalWireClient.php decrypts a selected patient document with Document::getdata() and SignalWireClient::uploadFileForFax() writes the plaintext bytes under sites/{siteId}/fax. The module returns the resulting public URL to SignalWire, protects it only with a predictable uniqid() filename, and never removes the staged file. An unauthenticated network actor who obtains or guesses the URL can retrieve persistent patient documents even when drive encryption is enabled. This issue is fixed in version 8.2.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenEMR FaxSMS moduleto a version that resolves this vulnerability.Fixed in 8.2.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
OpenEMR deployments running versions before 8.2.0 are affected when the FaxSMS module stages decrypted patient documents for fax transmission. An unauthenticated network actor can retrieve a document if they obtain or guess its staged URL.
Does disk or drive encryption prevent disclosure?
No. The affected code writes decrypted plaintext document bytes into the webroot, so drive encryption does not protect the files once the system is running.
What makes the staged documents accessible?
The module places files under sites/{siteId}/fax and exposes their public URLs to SignalWire. Filenames are protected only by a predictable uniqid() value, and the staged files are not removed.
What should be done if an immediate upgrade is not possible?
The provided information does not specify a workaround. Prioritize upgrading to OpenEMR 8.2.0, which fixes the issue.
How can administrators assess whether documents may already be exposed?
Review the sites/{siteId}/fax location for persistent staged files created by the FaxSMS module. The vulnerable behavior leaves decrypted patient documents there rather than removing them after upload.