CVE-2026-24488
Arbitrary File Exfiltration in OpenEMR Fax Endpoint
Publication date: 2026-02-27
Last updated on: 2026-03-03
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| open-emr | openemr | to 8.0.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in OpenEMR versions up to and including 8.0.0. It is an arbitrary file exfiltration vulnerability in the fax sending endpoint. Any authenticated user can exploit this flaw to read and transmit any file on the server, including sensitive files such as database credentials, patient documents, system files, and source code. This happens because the fax endpoint accepts arbitrary file paths from user input and streams those files to the fax gateway without any path restrictions or authorization checks.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized disclosure of sensitive information stored on the server. An attacker who exploits this can obtain critical data such as database credentials, confidential patient documents, system files, and source code. This can result in data breaches, loss of confidentiality, and potential further exploitation of the system.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
I don't know