Vulnerabilities

OpenEMR before 8.3.0 contains a path traversal vulnerability in the RingCentral RCFaxClient disposeDocument() method of oe-module-faxsms that allows…

OpenEMR before 8.3.0 contains a path traversal vulnerability in the RingCentral RCFaxClient disposeDocument() method of oe-module-faxsms that allows authenticated attackers to read and write arbitrary files via the file_path parameter. Attackers can use action=download to read credentials and source code, or action=setup with base64 content to write web-executable files for code execution.

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

Openemr

Product

openemr

CVSS v3.1

9.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness

CWE-73

Exposure class

OT / ICS

NVD status

Received

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-124490 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 30
   CVE NVD 2h ago

   OpenEMR before 8.3.0 contains a path traversal vulnerability in the FaxSMS module's RCFaxClient and SignalWireClient disposeDocument functions that…

   CVSS 8.8 CVE-2026-124446 Openemr