NVD-CVE-2026-124450
The CVE has recently been published to the CVE List and is now included within the NVD dataset.
OpenEMR before 8.3.0 contains a broken access control and path traversal vulnerability in the fax/sms module disposeDocument action via an unvalidated file_path parameter. Authenticated low-privilege users can read sqlconf.php to recover database credentials and write arbitrary files as the web user, enabling remote code execution.
References to Advisories, Solutions, and Tools
We hope your visit was informative.
We have provided a link to this site because it has information that may be of interest to our users. NIST does not necessarily endorse the views expressed or the facts presented on this site. Further, NIST does not endorse any commercial products that may be advertised or available on this site.
You will now be directed to:
We hope your visit was informative.
We have provided a link to this site because it has information that may be of interest to our users. NIST does not necessarily endorse the views expressed or the facts presented on this site. Further, NIST does not endorse any commercial products that may be advertised or available on this site.
You will now be directed to:
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
