OpenEMR: Arbitrary file read and write vulnerability (CVE-2026-124450)

OpenEMR versions prior to 8.3.0 contain a broken access control and path traversal vulnerability in the fax/sms module's 'disposeDocument' action. The vulnerability stems from an unvalidated 'file_path' parameter, which allows authenticated, low-privileged users to perform arbitrary file reads (including the retrieval of database credentials from 'sqlconf.php') and arbitrary file writes as the web service user, ultimately leading to remote code execution.

Impact

Authenticated low-privilege users can recover database credentials, modify application configuration, or achieve remote code execution on the underlying server as the web service user.

Recommendation

• Patch OpenEMR to version 8.3.0 or later immediately to resolve the vulnerability.
• Audit access logs for authentication-related activity followed by suspicious requests to the 'fax/sms' module.
• Monitor for unauthorized file modification in the OpenEMR web directory.