{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/openemr--7.0.4--7.0.4/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.9,"id":"CVE-2026-24849"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":["https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-DOANY1-CVE-2026-24849\u0026utm_source=rss\u0026utm_medium=rss"],"_cs_products":["OpenEMR \u003c 7.0.4 (\u003c 7.0.4)"],"_cs_severities":["high"],"_cs_tags":["webapps","arbitrary-file-read","openemr","cve"],"_cs_type":"advisory","_cs_vendors":["OpenEMR"],"content_html":"\u003cp\u003eA public exploit (EDB-52610) has been released for OpenEMR versions prior to 7.0.4, specifically tested on OpenEMR 7.0.2. This vulnerability, identified as CVE-2026-24849, is an authenticated arbitrary file read flaw located in the Fax/SMS module (\u003ccode\u003eoe-module-faxsms\u003c/code\u003e). The \u003ccode\u003eEtherFaxActions::disposeDoc()\u003c/code\u003e (or \u003ccode\u003edisposeDocument()\u003c/code\u003e) method, which is accessible via \u003ccode\u003eindex.php\u003c/code\u003e within the module, fails to validate the \u003ccode\u003efile_path\u003c/code\u003e request parameter before passing it to \u003ccode\u003ereadfile()\u003c/code\u003e. This allows any authenticated user with low privileges (e.g., receptionist, clinician) to read arbitrary files from the underlying server's filesystem, including sensitive configuration files like database credentials (\u003ccode\u003esqlconf.php\u003c/code\u003e) or system files (\u003ccode\u003e/etc/passwd\u003c/code\u003e). Furthermore, the \u003ccode\u003edisposeDoc()\u003c/code\u003e method calls \u003ccode\u003eunlink()\u003c/code\u003e on the target file after reading, introducing a destructive element where files can be deleted if the web server user has write permissions. The availability of this public exploit significantly increases the risk for unpatched OpenEMR instances.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003eInitial Access\u003c/strong\u003e: An attacker obtains valid login credentials for any low-privileged OpenEMR user account.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eAuthentication\u003c/strong\u003e: The attacker authenticates to the OpenEMR system, establishing a valid session.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eVulnerability Exploitation\u003c/strong\u003e: The attacker sends a specially crafted GET request to the vulnerable endpoint: \u003ccode\u003e/interface/modules/custom_modules/oe-module-faxsms/index.php\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eParameter Injection\u003c/strong\u003e: The GET request includes parameters such as \u003ccode\u003etype=fax\u003c/code\u003e, \u003ccode\u003e_ACTION_COMMAND\u003c/code\u003e (either \u003ccode\u003edisposeDoc\u003c/code\u003e or \u003ccode\u003edisposeDocument\u003c/code\u003e), \u003ccode\u003eaction=download\u003c/code\u003e, and a malicious \u003ccode\u003efile_path\u003c/code\u003e parameter pointing to a target file on the server's filesystem (e.g., \u003ccode\u003e/etc/passwd\u003c/code\u003e, \u003ccode\u003e/var/www/html/openemr/sites/default/sqlconf.php\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eArbitrary File Read\u003c/strong\u003e: The \u003ccode\u003edisposeDoc()\u003c/code\u003e method, lacking proper path validation, reads the content of the specified arbitrary file and returns it within the HTTP response body to the attacker.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eSensitive Data Exposure\u003c/strong\u003e: The attacker successfully retrieves sensitive information such as database credentials, API keys, or system configuration details.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eFile Deletion (Optional Impact)\u003c/strong\u003e: If the web server process has write permissions to the targeted file, the \u003ccode\u003edisposeDoc()\u003c/code\u003e method proceeds to call \u003ccode\u003eunlink()\u003c/code\u003e on the file, permanently deleting it from the server.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003ePost-Exploitation\u003c/strong\u003e: The attacker uses the exfiltrated sensitive data for further privilege escalation, lateral movement, or to gain control over the database.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe successful exploitation of CVE-2026-24849 can lead to severe consequences, including the unauthorized disclosure of highly sensitive data. Attackers can read critical system files like \u003ccode\u003e/etc/passwd\u003c/code\u003e to enumerate users or \u003ccode\u003esites/default/sqlconf.php\u003c/code\u003e to obtain database credentials, compromising patient records or administrative data. The ability to delete files via \u003ccode\u003eunlink()\u003c/code\u003e poses a risk of data destruction and denial of service if critical application files are targeted and removed. Although the exploit requires authentication, the low privilege level needed means many user accounts could be leveraged. Given OpenEMR's common use in healthcare, a breach could lead to HIPAA violations, significant financial penalties, reputational damage, and loss of patient trust for affected organizations.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003ePatch CVE-2026-24849\u003c/strong\u003e: Immediately upgrade OpenEMR instances to version 7.0.4 or higher to remediate CVE-2026-24849.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eDeploy Sigma Rules\u003c/strong\u003e: Implement the provided Sigma rules to your SIEM solution and configure web server logging (category \u003ccode\u003ewebserver\u003c/code\u003e) to monitor for exploitation attempts.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eMonitor Web Server Logs\u003c/strong\u003e: Actively monitor \u003ccode\u003ewebserver\u003c/code\u003e logs for requests to \u003ccode\u003e/interface/modules/custom_modules/oe-module-faxsms/index.php\u003c/code\u003e containing \u003ccode\u003e_ACTION_COMMAND\u003c/code\u003e and a \u003ccode\u003efile_path\u003c/code\u003e parameter, as detailed in the detection rules.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eReview Access Controls\u003c/strong\u003e: Periodically review and harden file system permissions on your OpenEMR deployment to follow the principle of least privilege, minimizing the impact even if a file read vulnerability is exploited.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-19T18:22:41Z","date_published":"2026-06-14T09:49:54Z","id":"https://feed.craftedsignal.io/briefs/2026-06-openemr-arbitrary-file-read/","summary":"A public exploit (EDB-52610) has been published for OpenEMR versions prior to 7.0.4, detailing an authenticated arbitrary file read vulnerability (CVE-2026-24849) in the Fax/SMS module's `EtherFaxActions::disposeDoc()` method, which allows a low-privileged authenticated user to read and potentially delete any file accessible by the web server user due to a lack of path validation on the `file_path` request parameter.","title":"OpenEMR Authenticated Arbitrary File Read (CVE-2026-24849)","url":"https://feed.craftedsignal.io/briefs/2026-06-openemr-arbitrary-file-read/"}],"language":"en","title":"CraftedSignal Threat Feed - OpenEMR \u003c 7.0.4 (\u003c 7.0.4)","version":"https://jsonfeed.org/version/1.1"}