CVE-2026-124467 OpenEMR before 8.4.0 Remote Code Execution via ESign LFI and fax upload
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-124467?
CVE-2026-124467 is a high-severity vulnerability in openemr, published on 8 Nov 2026.
Official description
OpenEMR before 8.4.0 contains a local file inclusion in the ESign router (library/ESign/Router.php), which passes the unsanitized module parameter into a require_once of '<module>/Controller.php', and the fax module's faxProcessUploads writes attacker-named files to a predictable temp path without extension checks. Authenticated attackers can upload a PHP file named Controller.php, then request interface/esign/index.php with a traversing module parameter to include it and execute arbitrary code.
Weakness: CWE-22
Which versions are affected by CVE-2026-124467?
How do I fix CVE-2026-124467?
No fix has been published for CVE-2026-124467 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-124467 being exploited?
There is no known exploitation of CVE-2026-124467 in the wild and no public exploit code.
Sources
Also known as GHSA-93j6-9h8j-mxgh, GHSA-p4v7-crwp-qq7q.