Openemr
CVE-2026-24848
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as OpenEMR user
-
ExploitCall disposeDocument() method via EtherFaxActions.php
-
ExecutionWrite malicious PHP file to web-accessible directory
-
ImpactExecute uploaded shell for RCE
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Authenticated user account in OpenEMR 7.0.4 or earlier with access to EtherFax functionality; web server must execute PHP files from upload destination directory |
| Impact | CVSS 9.9. Healthcare data exposure. |
| Exploit ScenarioDerived | Traverse filesystem to read patient records. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Path traversal in OpenEMR 7.0.4 disposeDocument() allows file access. PoC available.
Earlier versions of this analysis (1)
Path traversal in OpenEMR document disposal.
RemediationAI
Update OpenEMR.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-22 in disposeDocument().
Know when Openemr gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
OpenEMR is a free and open source electronic health records and medical practice management application. In 7.0.4 and earlier, the disposeDocument() method in EtherFaxActions.php allows authenticated users to write arbitrary content to arbitrary locations on the server filesystem. This vulnerability can be exploited to achieve Remote Code Execution (RCE) by uploading malicious PHP web shells.
Executive ViewAI
OpenEMR instances running version 7.0.4 or earlier contain a critical vulnerability allowing authenticated users to write arbitrary files to the server, potentially enabling complete system compromise, data theft, or ransomware deployment. This affects all organizations using vulnerable OpenEMR versions to manage patient records and practice operations.
Disable EtherFax module entirely if not in active use; implement Web Application Firewall (WAF) rules to block POST requests to EtherFaxActions.php containing suspicious file paths; restrict filesystem write permissions on the OpenEMR application directory to read-only where operationally feasible; implement strict input validation and file upload restrictions at the application level; isolate OpenEMR servers on a segregated network segment with egress filtering; monitor for and block execution of newly written files in application directories.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)GitHub Advisory
Related Vulnerabilities in OpenEMR Multiple Critical Vulnerabilities
View all 3An authenticated SQL injection vulnerability exists in OpenEMR ≤ 4.1.1 Patch 14 that allows a low-privileged attacker to
Path traversal in OpenEMR electronic health records before fix allows authenticated users to read arbitrary files on the
SQL injection in OpenEMR electronic health records before fix. Authenticated users can execute arbitrary SQL through the
OpenEMR 7.0.2 is vulnerable to SQL Injection via \openemr\library\classes\Pharmacy.class.php, \controllers\C_Pharmacy.cl
An issue in OpenEMR 7.0.2 allows a remote attacker to escalate privileges viaa crafted POST request using the noteid par
Remote code execution in OpenEMR through 8.2.0 lets an authenticated administrator poison the document category tree so
interface/fax/fax_dispatch.php in OpenEMR 4.1.0 allows remote authenticated users to execute arbitrary commands via shel
interface/globals.php in OpenEMR 2.x, 3.x, and 4.x before 4.2.0 patch 2 allows remote attackers to bypass authentication
Authentication bypass vulnerability in portal/account/register.php in versions of OpenEMR before 5.0.1.4 allows a remote
OpenEMR 5.0.0 and prior allows low-privilege users to upload files of dangerous types which can result in arbitrary code
Exploit-DB