Cpe:2.3:a:openemr:openemr:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aopenemropenemr/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 08 Nov 2026 16:50:56 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgOpenEMR: Arbitrary file read and write vulnerability (CVE-2026-124450)https://feed.craftedsignal.io/briefs/2026-11-openemr-path-traversal-803ffbda/Sun, 08 Nov 2026 16:50:56 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-openemr-path-traversal-803ffbda/OpenEMR versions prior to 8.3.0 are vulnerable to path traversal in the fax/sms module, allowing authenticated attackers to read sensitive files and execute arbitrary code via file write.OpenEMR versions prior to 8.3.0 contain a broken access control and path traversal vulnerability in the fax/sms module's 'disposeDocument' action. The vulnerability stems from an unvalidated 'file_path' parameter, which allows authenticated, low-privileged users to perform arbitrary file reads (including the retrieval of database credentials from 'sqlconf.php') and arbitrary file writes as the web service user, ultimately leading to remote code execution.

Impact

Authenticated low-privilege users can recover database credentials, modify application configuration, or achieve remote code execution on the underlying server as the web service user.

Recommendation

  • Patch OpenEMR to version 8.3.0 or later immediately to resolve the vulnerability.
  • Audit access logs for authentication-related activity followed by suspicious requests to the 'fax/sms' module.
  • Monitor for unauthorized file modification in the OpenEMR web directory.
]]>criticaladvisorycve-2026-124450path-traversalrcewebserver