Path Traversal and Broken Access Control in OpenEMR Leading to RCE

Executive Summary

CVE-2026-124450 is a critical vulnerability in OpenEMR versions before 8.3.0 affecting the fax/sms module. It involves broken access control and path traversal due to an unvalidated file_path parameter in the disposeDocument action. Authenticated low-privilege users can exploit this to read sensitive files like sqlconf.php, exposing database credentials, and write arbitrary files as the web user, enabling remote code execution.

Useful 0 Not Useful 0

Detection Guidance

Check OpenEMR version with: grep -r "OpenEMR" /var/www/html/openemr/version.php. If version is below 8.3.0, the system is vulnerable. Inspect fax/sms module logs for unusual file_path parameters in requests to /modules/fax_sms/disposeDocument.php.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers with low privileges to read sensitive files containing database credentials and patient records. They can also write arbitrary files, including web shells, which could lead to full system compromise and remote code execution if drive encryption is disabled.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can severely impact compliance with GDPR and HIPAA by exposing sensitive patient data through arbitrary file reads. Unauthorized access to database credentials and patient records violates confidentiality requirements, potentially leading to regulatory fines and legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenEMR to version 8.3.0 or later immediately. Temporarily restrict access to the fax/sms module by disabling it in the OpenEMR configuration. Monitor network traffic for suspicious requests to the disposeDocument endpoint.

Useful 0 Not Useful 0