Path Traversal in OpenEMR via RingCentral RCFaxClient

Executive Summary

CVE-2026-124490 is a path traversal vulnerability in OpenEMR versions before 8.3.0. It exists in the RingCentral RCFaxClient disposeDocument() method of the oe-module-faxsms module. Authenticated attackers can exploit the file_path parameter to read or write arbitrary files on the system. This can lead to exposure of sensitive data like credentials or source code, and even allow uploading malicious files for code execution.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized file reads or writes in OpenEMR's oe-module-faxsms module logs. Look for suspicious action=download or action=setup requests in web server logs targeting the disposeDocument() method. Verify if the RingCentral RCFaxClient is enabled and if file_path parameters contain path traversal sequences like ../.

Useful 0 Not Useful 0

Impact Analysis

If you use OpenEMR before version 8.3.0 with the oe-module-faxsms module enabled, attackers with valid credentials could read sensitive files such as configuration files or source code. They could also write malicious files to web-accessible directories, potentially leading to remote code execution and full system compromise.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive patient or user data, violating GDPR and HIPAA requirements for data protection and confidentiality. A successful exploit may result in data breaches, non-compliance penalties, and loss of trust in systems handling protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenEMR to version 8.3.0 or later immediately. Disable the oe-module-faxsms module if not required. Restrict file write permissions to web directories and audit all file operations. Implement strict input validation for file_path parameters and disable action=setup functionality.

Useful 0 Not Useful 0