CVE-2026-24488
Plain English Summary
AI-powered analysis for quick understanding
This vulnerability allows an attacker to send any file from the server, including sensitive information like database credentials and patient documents, to a phone number they control. It can be exploited by any authenticated user of the system, as the application does not properly restrict which files can be accessed or sent.
Technical Description
OpenEMR is a free and open source electronic health records and medical practice management application. In versions up to and including 8.0.0, an arbitrary file exfiltration vulnerability in the fax sending endpoint allows any authenticated user to read and transmit any file on the server (including database credentials, patient documents, system files, and source code) via fax to an attacker-controlled phone number. The vulnerability exists because the endpoint accepts arbitrary file paths from user input and streams them to the fax gateway without path restrictions or authorization checks. As of time of publication, no known patched versions are available.
CVSS Vector Analysis
Vector String
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploit Resources
Search for proof-of-concept code and exploit modules
Official References
Quick Information
Published
Feb 27, 2026
about 1 month ago
Last Modified
Mar 3, 2026
about 1 month ago
Vendor
open-emr
Product
openemr
Related Vulnerabilities
This vulnerability allows an attacker to bypass authorization controls and gain access to restricted areas of the OpenEMR application. To exploit this, the attacker needs to manipulate a user-controlled key, which could happen if they have access to the application or its configuration.
This vulnerability allows an attacker to access sensitive information or perform unauthorized actions within the OpenEMR system if they can exploit the missing authorization checks. It affects versions prior to 7.0.0.1, meaning users running older versions are at risk.