{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/openemr--8.4.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-124467"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OpenEMR (\u003c 8.4.0)"],"_cs_severities":["high"],"_cs_tags":["lfi","rce","web-vulnerability"],"_cs_type":"advisory","_cs_vendors":["OpenEMR"],"content_html":"\u003cp\u003eOpenEMR versions before 8.4.0 contain a local file inclusion (LFI) vulnerability in the ESign router component located in \u003ccode\u003elibrary/ESign/Router.php\u003c/code\u003e. The vulnerability arises because the \u003ccode\u003emodule\u003c/code\u003e parameter is passed into a \u003ccode\u003erequire_once\u003c/code\u003e statement without sanitization. Additionally, the application's fax module (\u003ccode\u003efaxProcessUploads\u003c/code\u003e) allows the writing of files with attacker-controlled content to a predictable temporary path without validating file extensions. An authenticated attacker can combine these flaws to upload a malicious PHP file masquerading as a controller, and then trigger its execution by requesting the ESign index file with a path-traversal payload in the \u003ccode\u003emodule\u003c/code\u003e parameter.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker authenticates to the OpenEMR instance.\u003c/li\u003e\n\u003cli\u003eAttacker interacts with the fax module via \u003ccode\u003efaxProcessUploads\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAttacker uploads a file containing malicious PHP code.\u003c/li\u003e\n\u003cli\u003eThe application saves the file to a predictable temporary directory on the server.\u003c/li\u003e\n\u003cli\u003eAttacker makes a request to \u003ccode\u003einterface/esign/index.php\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAttacker provides a path-traversal string in the \u003ccode\u003emodule\u003c/code\u003e parameter to point to the uploaded PHP file.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003elibrary/ESign/Router.php\u003c/code\u003e executes \u003ccode\u003erequire_once\u003c/code\u003e on the malicious file, resulting in remote code execution.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an authenticated attacker to achieve remote code execution on the underlying server, potentially leading to full system compromise.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade OpenEMR to version 8.4.0 or later immediately to address the vulnerabilities in the ESign router and fax module.\u003c/li\u003e\n\u003cli\u003eReview access logs for requests to \u003ccode\u003einterface/esign/index.php\u003c/code\u003e containing path traversal sequences (e.g., \u003ccode\u003e../\u003c/code\u003e, \u003ccode\u003e..%2f\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eAudit the temporary directory used by the fax module for unexpected \u003ccode\u003e.php\u003c/code\u003e files.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-08T23:20:40Z","date_published":"2026-11-08T23:20:40Z","id":"https://feed.craftedsignal.io/briefs/2026-11-openemr-lfi/","summary":"OpenEMR versions prior to 8.4.0 contain a local file inclusion vulnerability in the ESign router, allowing authenticated attackers to execute arbitrary code via a malicious file upload.","title":"OpenEMR: Local file inclusion and remote code execution (CVE-2026-124467)","url":"https://feed.craftedsignal.io/briefs/2026-11-openemr-lfi/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-124484"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OpenEMR (\u003c 8.4.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["OpenEMR"],"content_html":"\u003cp\u003eOpenEMR versions before 8.4.0 contain an authorization vulnerability in the portal onsite-document API endpoints. The vulnerability allows an authenticated core user to access, list, read, or overwrite cross-patient documents, signatures, and template data. This is achieved by omitting the 'patientId' parameter from API requests and providing arbitrary record IDs.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in unauthorized access to sensitive medical records and the ability to modify or overwrite patient document data and signatures, potentially leading to unauthorized data exposure and integrity loss.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch OpenEMR to version 8.4.0 or later immediately to remediate the authorization check flaw.\u003c/li\u003e\n\u003cli\u003eAudit web server logs for requests to portal onsite-document API endpoints that lack a 'patientId' parameter.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-08T15:36:31Z","date_published":"2026-11-08T15:36:31Z","id":"https://feed.craftedsignal.io/briefs/2026-11-openemr-auth-bypass-26f41790/","summary":"OpenEMR versions prior to 8.4.0 contain a missing authorization flaw allowing authenticated users to access and modify cross-patient records by manipulating API parameters.","title":"OpenEMR: Missing authorization in portal onsite-document APIs (CVE-2026-124484)","url":"https://feed.craftedsignal.io/briefs/2026-11-openemr-auth-bypass-26f41790/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.3,"id":"CVE-2026-124483"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OpenEMR (\u003c 8.4.0)"],"_cs_severities":["high"],"_cs_tags":["web-application","medical-software","authorization-bypass","cve-2026-124483"],"_cs_type":"advisory","_cs_vendors":["OpenEMR"],"content_html":"\u003cp\u003eOpenEMR versions before 8.4.0 contain an incorrect authorization vulnerability in the prescription REST API. The API improperly validates requests by checking the patients.med ACL instead of the intended patients.rx ACL and fails to verify required permission bits. This allows an authenticated staff user with basic read-only access to perform unauthorized actions, including the enumeration of prescription UUIDs, the forging of prescriptions for any patient, and the deactivation of existing prescriptions across the system.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows authenticated staff users to manipulate prescription data, which could result in unauthorized medical prescriptions or the disruption of existing patient care. The scope of the vulnerability is tenant-wide.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade OpenEMR to version 8.4.0 or later to apply the fix for CVE-2026-124483.\u003c/li\u003e\n\u003cli\u003eUntil patching is complete, audit access logs for high-frequency or unauthorized access to prescription REST API endpoints by users who do not require such access for their roles.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-08T15:36:23Z","date_published":"2026-11-08T15:36:23Z","id":"https://feed.craftedsignal.io/briefs/2026-11-openemr-auth-bypass-ba3c3f5b/","summary":"OpenEMR versions prior to 8.4.0 contain an incorrect authorization flaw in the prescription REST API, allowing authenticated staff to forge or deactivate patient prescriptions.","title":"OpenEMR: Incorrect authorization in prescription REST API (CVE-2026-124483)","url":"https://feed.craftedsignal.io/briefs/2026-11-openemr-auth-bypass-ba3c3f5b/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-124480"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OpenEMR (\u003c 8.4.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["OpenEMR"],"content_html":"\u003cp\u003eOpenEMR versions prior to 8.4.0 contain an authorization bypass vulnerability in the FHIR API implementation. Authenticated users with low privileges can bypass FHIR scope restrictions by reusing the 'api_csrf_token_js' value from a session in an 'APICSRFTOKEN' HTTP header. This enables unauthorized access to cross-patient 'QuestionnaireResponse' data, leading to the potential exfiltration of sensitive protected health information (PHI) via the 'GET /fhir/QuestionnaireResponse' endpoint.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows low-privileged users to exfiltrate site-wide PHI contained within FHIR QuestionnaireResponse objects, bypassing existing scope controls.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to OpenEMR 8.4.0 or later to remediate the authorization logic in the FHIR API.\u003c/li\u003e\n\u003cli\u003eAudit access logs for the 'GET /fhir/QuestionnaireResponse' endpoint to identify patterns of unauthorized enumeration by low-privileged accounts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-08T15:36:16Z","date_published":"2026-11-08T15:36:16Z","id":"https://feed.craftedsignal.io/briefs/2026-11-openemr-auth-bypass-18ffda42/","summary":"OpenEMR versions before 8.4.0 contain an authorization bypass vulnerability allowing authenticated users to exfiltrate cross-patient questionnaire data via the FHIR API.","title":"OpenEMR: FHIR API authorization bypass (CVE-2026-124480)","url":"https://feed.craftedsignal.io/briefs/2026-11-openemr-auth-bypass-18ffda42/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-124466"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OpenEMR (\u003c 8.4.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["OpenEMR"],"content_html":"\u003cp\u003eOpenEMR versions before 8.4.0 are susceptible to a server-side request forgery (SSRF) vulnerability. The flaw exists within the OAuth2 client registration mechanism, where an unvalidated \u003ccode\u003ejwks_uri\u003c/code\u003e can be registered. An unauthenticated attacker can subsequently invoke the token introspection endpoint using an unsigned \u003ccode\u003eclient_assertion\u003c/code\u003e, forcing the OpenEMR server to initiate HTTP requests to arbitrary destinations. This can be used to perform internal network reconnaissance or access sensitive cloud metadata services.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to interact with internal-only services or cloud metadata endpoints (e.g., 169.254.169.254) from the perspective of the vulnerable server, potentially leading to unauthorized data access or credential exfiltration.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade OpenEMR to version 8.4.0 or later immediately.\u003c/li\u003e\n\u003cli\u003eAudit OAuth2 client registration logs for suspicious \u003ccode\u003ejwks_uri\u003c/code\u003e entries pointing to unexpected domains or internal IP ranges.\u003c/li\u003e\n\u003cli\u003eRestrict the server's egress traffic via network security groups to prevent unauthorized outbound connections to internal service endpoints or cloud metadata services.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-08T15:34:48Z","date_published":"2026-11-08T15:34:48Z","id":"https://feed.craftedsignal.io/briefs/2026-11-openemr-ssrf/","summary":"OpenEMR versions prior to 8.4.0 contain an SSRF vulnerability in the OAuth2 client registration process that allows unauthenticated attackers to probe internal services and cloud metadata endpoints.","title":"OpenEMR: Server-side request forgery in OAuth2 client registration (CVE-2026-124466)","url":"https://feed.craftedsignal.io/briefs/2026-11-openemr-ssrf/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-124444"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OpenEMR (\u003c 8.4.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eOpenEMR before 8.4.0 contains a mass assignment vulnerability in the patient portal OnsiteDocument query API. The flaw allows request parameters to set bitwise criteria filters that are placed unquoted into the SQL WHERE clause. Authenticated patient portal users can exploit this to perform SQL injection and read any database table, including other patients' records and staff password hashes.\u003c/p\u003e\n","date_modified":"2026-11-08T15:31:22Z","date_published":"2026-11-08T15:31:22Z","id":"https://feed.craftedsignal.io/briefs/2026-11-openemr-sql-injection/","summary":"OpenEMR versions before 8.4.0 contain a mass assignment vulnerability in the patient portal OnsiteDocument query API that facilitates SQL injection.","title":"OpenEMR: SQL injection via mass assignment in patient portal (CVE-2026-124444)","url":"https://feed.craftedsignal.io/briefs/2026-11-openemr-sql-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - OpenEMR (\u003c 8.4.0)","version":"https://jsonfeed.org/version/1.1"}