Sploitus

Vulnerability in OpenEMR Enables Remote Code Execution

First seen 9 Nov 2026, 00:48 UTC • •78.0

Article Content

1 / 6

Browse articles

ThreatCluster •November 9, 2026 at 00:49 UTC

•OpenEMR versions before 8.3.0 are vulnerable to a critical flaw.
•The vulnerability allows low-privilege users to execute arbitrary code remotely.
•Users are advised to upgrade to version 8.3.0 to mitigate the risk.

A vulnerability (CVE-2026-124450) has been identified in OpenEMR versions prior to 8.3.0, specifically within the fax/sms module. The flaw involves broken access control and path traversal through an unvalidated file_path parameter. This allows authenticated low-privilege users to read sensitive files, such as sqlconf.php, which contains database credentials. Consequently, attackers can write arbitrary files as the web user, leading to potential remote code execution. The CVE was published on November 8, 2026, with a CVSS score of 9.3, indicating a severity level. Users of OpenEMR are urged to update to version 8.3.0 or later to mitigate this risk. There is currently no indication of in the wild.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 7h ago How this analysis works

Timeline

2026-11-08

CVE-2026-124450 published

OpenEMR vulnerability disclosed, allowing remote code execution via broken access control.

2026-11-08

Sploitus reports vulnerability details

Sploitus confirms the critical flaw in OpenEMR and its implications for low-privilege users.

More articles in this cluster (5)

Threat Graph

8 entities, 7 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

Zero-day Exploit
T1203 - Exploitation for Client Execution

Vulnerability (3)

CVE-2026-124450
Broken Access Control
Path Traversal

Weakness (2)

CWE-200 - Exposure of Sensitive Information
CWE-22 - Path Traversal

Affected Platform (1)

OpenEMR

Relationships

CVE-2026-124450 targets OpenEMR
Broken Access Control targets OpenEMR
Path Traversal targets OpenEMR
Zero-day Exploit targets OpenEMR
T1203 - Exploitation for Client Execution targets OpenEMR
CVE-2026-124450 related to CWE-200 - Exposure of Sensitive Information
CVE-2026-124450 related to CWE-22 - Path Traversal

Following this threat?

Track CVE-2026-124450 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Common questions

Which versions of OpenEMR are affected?

OpenEMR versions prior to 8.3.0 are affected by this vulnerability.

Is there a patch available?

Yes, users should upgrade to OpenEMR version 8.3.0 or later to address this vulnerability.

Are there any known exploits in the wild?

Currently, there is no evidence of active exploitation of this vulnerability.

Continue Reading

Volt Typhoon's Silent Train Network Targets US Critical Infrastructure The Chinese state-sponsored hacking group Volt Typhoon has been linked to a covert network called Silent Train, which has exploited at least four zero-day vulnerabilities over three years. This network utilizes rapidly rotating chains of compromised SOHO routers, IoT devices, and enterprise infrastructure to access…

GitLab Issues Emergency Patch for Critical RCE Vulnerability GitLab has released emergency patches for a critical remote code execution vulnerability, CVE-2026-97229, affecting its Community and Enterprise Editions. This flaw, stemming from an integer overflow in the CI/CD regular expression compiler, allows unauthenticated attackers to execute arbitrary code via specially…