OpenEMR: Local file inclusion and remote code execution (CVE-2026-124467)

OpenEMR versions before 8.4.0 contain a local file inclusion (LFI) vulnerability in the ESign router component located in library/ESign/Router.php. The vulnerability arises because the module parameter is passed into a require_once statement without sanitization. Additionally, the application's fax module (faxProcessUploads) allows the writing of files with attacker-controlled content to a predictable temporary path without validating file extensions. An authenticated attacker can combine these flaws to upload a malicious PHP file masquerading as a controller, and then trigger its execution by requesting the ESign index file with a path-traversal payload in the module parameter.

Attack Chain

1. Attacker authenticates to the OpenEMR instance.
2. Attacker interacts with the fax module via faxProcessUploads.
3. Attacker uploads a file containing malicious PHP code.
4. The application saves the file to a predictable temporary directory on the server.
5. Attacker makes a request to interface/esign/index.php.
6. Attacker provides a path-traversal string in the module parameter to point to the uploaded PHP file.
7. library/ESign/Router.php executes require_once on the malicious file, resulting in remote code execution.

Impact

Successful exploitation allows an authenticated attacker to achieve remote code execution on the underlying server, potentially leading to full system compromise.

Recommendation

• Upgrade OpenEMR to version 8.4.0 or later immediately to address the vulnerabilities in the ESign router and fax module.
• Review access logs for requests to interface/esign/index.php containing path traversal sequences (e.g., ../, ..%2f).
• Audit the temporary directory used by the fax module for unexpected .php files.