External risk intelligence

OpenEMR Fax SMS Module Broken Access Control and Path Traversal Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-124450

OpenEMR is a web-based electronic health record application typically deployed as an internet-facing web application to allow authorized users, such as medical staff or patients, to access records remotely. Because the application is designed to be accessed via web browsers over a network, the vulnerable modules are commonly exposed in standard deployments.

Path Traversal

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory highlights a vulnerability in OpenEMR, a widely used electronic health record system. The issue could allow authenticated users with low-level access to potentially gain control of the system, access sensitive data, and execute arbitrary code. The main concern is confirming if this specific application is in use and, if so, understanding the extent of exposure.

Low-privilege users can gain system control.
Understand if OpenEMR is in use internally.
Assess relevance and potential exposure to critical systems.

Attack Path

How an attacker could exploit the issue

An attacker with low-level access to OpenEMR could exploit a flaw in the fax/sms module. By manipulating a file path parameter, they can read sensitive configuration files to obtain database credentials. This access can then be leveraged to write arbitrary files, potentially leading to remote code execution on the server.

Requires authenticated low-privilege access.
Triggers via unvalidated file path parameter.
Risk of database credential theft and RCE.

Live Threat

Current exploitation, exposure, and threat context

Authenticated, low-privilege users could exploit this vulnerability to read sensitive database configuration files and write arbitrary files as the web server user. This could lead to remote code execution when the fax/sms module's disposeDocument action is supported.

Database credentials could be exposed.
Unvalidated file path allows arbitrary writes.
Remote code execution may be possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts OpenEMR, a web-based electronic health record system. The fax/SMS module's disposeDocument action is susceptible to broken access control and path traversal. System owners and security teams should prioritize identifying all OpenEMR instances, confirming their reachability and business criticality, and then assigning ownership for remediation planning.

Identify OpenEMR instances and their exposure.
Verify affected modules and critical data.
Plan remediation or compensating controls.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is OpenEMR?

OpenEMR is an open-source, web-based electronic health record and medical practice management software. It is used by clinics and healthcare providers to manage patient medical records, scheduling, and billing. Because it stores sensitive health data, it is typically hosted as a web application that allows staff or patients to log in and interact with records remotely over a network.

How does CVE-2026-124450 work?

This CVE involves a weakness known as Path Traversal, categorized as CWE-73. It happens when an application fails to properly sanitize user input used in file paths. In this specific case, the fax/SMS module does not validate the file_path parameter. By sending specially crafted input to the disposeDocument action, an authenticated user can trick the system into accessing files outside the intended folder, such as configuration files that store database passwords.

What triggers this vulnerability?

The vulnerability is triggered when an authenticated user—even one with low-level access permissions—interacts with the disposeDocument action in the fax/SMS module. It requires valid user authentication to reach this specific function; simply browsing to the application without a session will not trigger the bug. If a deployment does not utilize or has disabled the fax/SMS module, the specific trigger path for this vulnerability is not present.

Is my OpenEMR instance at high risk?

According to Halo Surface Signal, risk is elevated if your installation is internet-facing. Because OpenEMR is frequently deployed to allow remote access for staff, many instances are reachable from the public web. If your instance is exposed to the internet, unauthorized individuals who obtain low-level user credentials can leverage this flaw to move beyond their assigned permissions, potentially compromising the entire server.

What should I do to protect my system?

Begin by auditing your environment to locate all running OpenEMR instances. Confirm the specific version in use, as the vulnerability affects versions prior to 8.3.0. Prioritize limiting network access to these instances, ensuring they are not unnecessarily exposed to the public internet. Document ownership for each instance and coordinate with your technical team to apply vendor-provided updates as soon as they are available.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.