Local File Inclusion in OpenEMR Leading to RCE

Executive Summary

CVE-2026-124467 is a critical Remote Code Execution (RCE) vulnerability in OpenEMR versions before 8.4.0. It combines two flaws: a Local File Inclusion (LFI) in the ESign module and an unrestricted file upload in the fax module. The LFI allows directory traversal via an unsanitized 'module' parameter, enabling inclusion of attacker-controlled files. The fax module permits uploading PHP files named 'Controller.php' to a predictable temp directory without extension checks. An authenticated attacker can upload a malicious PHP file and trigger its execution via the LFI, leading to arbitrary code execution as the web server user.

Useful 0 Not Useful 0

Detection Guidance

Check for OpenEMR versions prior to 8.4.0 by inspecting the version file or running commands like grep -r 'openemr' /var/www/html or similar paths depending on installation. Look for the fax module being enabled and configured with a vendor. Review logs for suspicious file uploads to temp directories or requests to interface/esign/index.php with unusual module parameters.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows authenticated attackers to execute arbitrary code on the server running OpenEMR. If exploited, it could lead to full system compromise, data theft, unauthorized access, or disruption of services. The impact depends on the server's role and data sensitivity. Attackers could install malware, modify or delete data, or pivot to other systems in the network.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could severely impact compliance with GDPR, HIPAA, and other regulations. It may lead to unauthorized access to sensitive personal or health data, violating confidentiality requirements. Organizations could face fines, legal actions, or reputational damage due to data breaches resulting from this exploit.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenEMR to version 8.4.0 or later immediately. Disable the fax module if not required. Implement strict file upload restrictions to prevent PHP file uploads. Sanitize the module parameter in library/ESign/Router.php to prevent directory traversal. Review and restrict file permissions in temporary directories used by the fax module.

Useful 0 Not Useful 0