CVE-2026-24488: OpenEMR Path Traversal Vulnerability

CVE-2026-24488 Overview

OpenEMR is a free and open source electronic health records (EHR) and medical practice management application widely used in healthcare environments. A critical path traversal vulnerability has been identified in versions up to and including 8.0.0 that allows any authenticated user to read and transmit arbitrary files from the server via the fax sending endpoint. This vulnerability enables attackers to exfiltrate sensitive data including database credentials, patient documents, system files, and application source code by faxing them to an attacker-controlled phone number.

Critical Impact

Authenticated attackers can exfiltrate any file on the server including protected health information (PHI), database credentials, and system configuration files through the fax gateway, potentially leading to HIPAA violations and complete system compromise.

Affected Products

• OpenEMR versions up to and including 8.0.0
• OpenEMR installations with the oe-module-faxsms custom module enabled
• Healthcare environments using EtherFax integration

Discovery Timeline

• 2026-02-27 - CVE-2026-24488 published to NVD
• 2026-03-03 - Last updated in NVD database

Technical Details for CVE-2026-24488

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Path Traversal), where the fax sending endpoint in the EtherFaxActions controller accepts arbitrary file paths from user input and streams them directly to the fax gateway without implementing proper path restrictions or authorization checks. The flaw allows any authenticated user, regardless of their privilege level within the OpenEMR application, to specify any file path on the server and have its contents transmitted via fax to a destination of their choosing.

The attack is particularly dangerous in healthcare environments because it can be used to exfiltrate protected health information (PHI), potentially resulting in HIPAA violations and significant regulatory penalties. Additionally, by targeting configuration files containing database credentials, an attacker could gain access to the underlying database and escalate their attack further.

Root Cause

The root cause of this vulnerability lies in the EtherFaxActions.php controller within the oe-module-faxsms custom module. The vulnerable code path accepts user-supplied file paths without validating that the requested file resides within an allowed directory or that the authenticated user has authorization to access the specified resource. This lack of input validation and access control allows path traversal sequences to be used to access files outside the intended directory structure.

Attack Vector

The attack is network-based and requires only low-privileged authentication to the OpenEMR application. An attacker can exploit this vulnerability by:

1. Authenticating to OpenEMR with any valid user account
2. Crafting a request to the fax sending endpoint with a malicious file path parameter
3. Specifying an attacker-controlled fax number as the destination
4. The server reads the specified file and transmits its contents via fax

The vulnerability is particularly concerning because it bypasses normal file access controls and allows any authenticated user to access files they would not normally have permission to view, including system files, database credentials stored in configuration files, and other patients' medical records.

For detailed technical information about the vulnerable code, see the EtherFaxActions.php source code and the GitHub Security Advisory GHSA-765x-8v97-c7g8.

Detection Methods for CVE-2026-24488

Indicators of Compromise

• Unusual fax transmission requests containing path traversal sequences (../ or absolute paths)
• Fax requests targeting sensitive files such as /etc/passwd, sqlconf.php, or patient document directories
• Unexpected fax transmissions to unrecognized phone numbers
• Log entries showing access to the EtherFaxActions endpoint with suspicious file path parameters

Detection Strategies

• Monitor web server access logs for requests to the fax sending endpoint containing path traversal patterns
• Implement file integrity monitoring on sensitive configuration files and directories
• Alert on fax transmissions to phone numbers outside of pre-approved destination lists
• Review audit logs for authenticated users accessing the fax module with unusual frequency or patterns

Monitoring Recommendations

• Enable verbose logging for the oe-module-faxsms module to capture all fax transmission requests
• Configure SIEM rules to detect path traversal sequences in HTTP request parameters
• Monitor outbound fax gateway traffic for unusual file transmission patterns
• Implement user behavior analytics to identify anomalous access patterns to the fax functionality

How to Mitigate CVE-2026-24488

Immediate Actions Required

• Disable the oe-module-faxsms custom module if fax functionality is not critical to operations
• Implement network-level restrictions to limit access to the fax sending endpoint
• Review and restrict user accounts that have access to the fax functionality
• Audit recent fax transmission logs for evidence of exploitation

Patch Information

As of the time of publication, no known patched versions are available from the vendor. Organizations should monitor the GitHub Security Advisory for updates on patch availability and apply security updates immediately when released.

Workarounds

• Disable the EtherFax module entirely by removing or disabling the oe-module-faxsms custom module
• Implement a web application firewall (WAF) rule to block requests containing path traversal sequences to the fax endpoint
• Restrict access to the fax functionality through role-based access controls to only essential personnel
• Consider implementing application-level file path validation as a custom security control

# Disable the oe-module-faxsms module (adjust path as needed for your installation)
cd /var/www/html/openemr/interface/modules/custom_modules
mv oe-module-faxsms oe-module-faxsms.disabled

# Set restrictive permissions on sensitive directories
chmod -R 600 /var/www/html/openemr/sites/*/sqlconf.php
chmod -R 750 /var/www/html/openemr/sites/*/documents