OpenEMR: Path traversal in RingCentral RCFaxClient (CVE-2026-124490)

OpenEMR versions before 8.3.0 contain a path traversal vulnerability in the RingCentral RCFaxClient disposeDocument() method of the oe-module-faxsms component. An authenticated attacker can exploit the file_path parameter to read sensitive files, such as configuration files containing credentials or source code. Furthermore, an attacker can use the action=setup parameter with base64-encoded content to write web-executable files, leading to remote code execution.

Impact

The vulnerability allows authenticated attackers to perform unauthorized file system reads and writes, resulting in potential exposure of sensitive data (credentials/source code) and full system compromise via remote code execution.

Recommendation

• Upgrade OpenEMR to version 8.3.0 or later immediately to resolve the vulnerable disposeDocument() method.
• Audit web server access logs for requests directed at the oe-module-faxsms component containing path traversal patterns (e.g., ../, ..).
• Review user access privileges for the OpenEMR instance to limit exposure to authenticated session exploitation.