OpenEMR: arbitrary file read and write

OpenEMR

OpenEMR before 8.3.0 contains a broken access control and path traversal vulnerability in the fax/sms module disposeDocument action via an unvalidated file_path parameter. Authenticated low-privilege users can read sqlconf.php to recover database credentials and write arbitrary files as the web user, enabling remote code execution.

Do this now

Check the vendor's advisory for a fix, restrict access to the fax module, and rotate the database credentials.

Who should check: teams running Healthcare IT or PHP

First seen: 9 Nov 2026
Last update: 9 Nov 2026, 11:17 UTC
Versions per the CVE record from VulnCheck, not the vendor: 8.3.0
Identifiers: CVE-2026-124450
CVSS: 9.9
Source: news
On the menu as: Healthcare IT
PHP

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## OpenEMR: arbitrary file read and write
Severity: critical. Patch status: fix status unknown.
Affected: OpenEMR
Versions per the CVE record from VulnCheck, not the vendor: 8.3.0
Ids: CVE-2026-124450

OpenEMR before 8.3.0 contains a broken access control and path traversal vulnerability in the fax/sms module disposeDocument action via an unvalidated file_path parameter. Authenticated low-privilege users can read sqlconf.php to recover database credentials and write arbitrary files as the web user, enabling remote code execution.

## Steps
1. Search the repo, its CI and infra config for OpenEMR. If present, report the version in use and whether it's affected.
2. Versions per the CVE record from VulnCheck, not the vendor: OpenEMR: 8.3.0. Don't treat them as a fix until the vendor says so.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| OpenEMR | per the CVE record from VulnCheck, not the vendor | 8.3.0 | restrict network access to it |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-124450") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://github.com/openemr/openemr/security/advisories/GHSA-wf4w-mx2w-j4vv https://nvd.nist.gov/vuln/detail/CVE-2026-124450
https://pwned.coffee/i/fax-remote-code-execution-cve-2026-124450

Receipt

Exploitation: Public exploit code, no attacks reported
Checked by hand “The CVE record is titled "OpenEMR before 8.3.0 Arbitrary File Read/Write via disposeDocument"; the flaw sits in the fax/sms module, and code execution is what the file write can lead to. The stored title was "Fax: remote code execution".” source
CISA ADP “CISA ADP rates exploitation of CVE-2026-124450 "poc" (SSVC).” source
By release line, per the CVE record from VulnCheck, not the vendor: Product Affected Version named Source
OpenEMR before 8.3.0 8.3.0 CVE record (CNA) per the CVE record from VulnCheck, not the vendor checked 13 Nov
Score: CVSS 9.9 (critical). CVSS 3.1 9.9 (CNA VulnCheck) for CVE-2026-124450
Last checked: 13 Nov 2026, 16:26 UTC

Product	Affected	Version named	Source
OpenEMR	before 8.3.0	8.3.0	CVE record (CNA) per the CVE record from VulnCheck, not the vendor checked 13 Nov

Sources: KEV – CVE record ✓ Vendor –

Sources

Follow on X

Totalone very hot coffee