Attack Chain

1. Attacker authenticates to the OpenEMR instance.
2. Attacker interacts with the fax module via faxProcessUploads.
3. Attacker uploads a file containing malicious PHP code.
4. The application saves the file to a predictable temporary directory on the server.
5. Attacker makes a request to interface/esign/index.php.
6. Attacker provides a path-traversal string in the module parameter to point to the uploaded PHP file.
7. library/ESign/Router.php executes require_once on the malicious file, resulting in remote code execution.

Impact

Successful exploitation allows an authenticated attacker to achieve remote code execution on the underlying server, potentially leading to full system compromise.

Recommendation

• Upgrade OpenEMR to version 8.4.0 or later immediately to address the vulnerabilities in the ESign router and fax module.
• Review access logs for requests to interface/esign/index.php containing path traversal sequences (e.g., ../, ..%2f).
• Audit the temporary directory used by the fax module for unexpected .php files.

Impact

Successful exploitation results in unauthorized access to sensitive medical records and the ability to modify or overwrite patient document data and signatures, potentially leading to unauthorized data exposure and integrity loss.

Recommendation

• Patch OpenEMR to version 8.4.0 or later immediately to remediate the authorization check flaw.
• Audit web server logs for requests to portal onsite-document API endpoints that lack a 'patientId' parameter.

Impact

Successful exploitation allows authenticated staff users to manipulate prescription data, which could result in unauthorized medical prescriptions or the disruption of existing patient care. The scope of the vulnerability is tenant-wide.

Recommendation

• Upgrade OpenEMR to version 8.4.0 or later to apply the fix for CVE-2026-124483.
• Until patching is complete, audit access logs for high-frequency or unauthorized access to prescription REST API endpoints by users who do not require such access for their roles.

Impact

Successful exploitation allows low-privileged users to exfiltrate site-wide PHI contained within FHIR QuestionnaireResponse objects, bypassing existing scope controls.

Recommendation

• Upgrade to OpenEMR 8.4.0 or later to remediate the authorization logic in the FHIR API.
• Audit access logs for the 'GET /fhir/QuestionnaireResponse' endpoint to identify patterns of unauthorized enumeration by low-privileged accounts.

Impact

Successful exploitation allows unauthenticated attackers to interact with internal-only services or cloud metadata endpoints (e.g., 169.254.169.254) from the perspective of the vulnerable server, potentially leading to unauthorized data access or credential exfiltration.

Recommendation

• Upgrade OpenEMR to version 8.4.0 or later immediately.
• Audit OAuth2 client registration logs for suspicious jwks_uri entries pointing to unexpected domains or internal IP ranges.
• Restrict the server's egress traffic via network security groups to prevent unauthorized outbound connections to internal service endpoints or cloud metadata services.