CVE-2026-124490: openemr (Critical, CVSS 9.4)
- CVSS
- 9.4 Critical (v4.0)
- EPSS
- 0.4% chance of exploitation in the next 30 days (higher than 29.6% of CVEs)
- Exploited in the wild
- Not on CISA’s KEV list
- Public exploit
- None reported in public exploit databases
- Weakness
- CWE-73
- Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H- Published
- Nov 8, 2026
What it is
OpenEMR before 8.3.0 contains a path traversal vulnerability in the RingCentral RCFaxClient disposeDocument() method of oe-module-faxsms that allows authenticated attackers to read and write arbitrary files via the file_path parameter. Attackers can use action=download to read credentials and source code, or action=setup with base64 content to write web-executable files for code execution.
Description from the National Vulnerability Database.
What to do
Check whether you run openemr, then apply the vendor’s fix or mitigation from the advisories below.
Sources: NVD, FIRST EPSS, CISA KEV, and public exploit databases (availability only). ThreatRoundup reports whether public exploit code exists but never links to it: fake proof-of-concepts that infect security researchers are common. This page updates automatically.