CVE-2026-124450 OpenEMR before 8.3.0 Arbitrary File Read/Write via disposeDocument
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-124450?
CVE-2026-124450 is a critical vulnerability in openemr, published on 8 Nov 2026.
Official description
OpenEMR before 8.3.0 contains a broken access control and path traversal vulnerability in the fax/sms module disposeDocument action via an unvalidated file_path parameter. Authenticated low-privilege users can read sqlconf.php to recover database credentials and write arbitrary files as the web user, enabling remote code execution.
Weakness: CWE-73
Which versions are affected by CVE-2026-124450?
How do I fix CVE-2026-124450?
No fix has been published for CVE-2026-124450 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-124450 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-124450 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-cq78-6jw9-4cxm, GHSA-wf4w-mx2w-j4vv.