A critical flaw in OpenEMR, the widely used open-source electronic health records system, could let a logged-in attacker read and write any file on the server, including patient database credentials. The vulnerability, CVE-2026-124490, was published on 8 November 2026 and scores 9.4 out of 10 under CVSS version 4.0.

The flaw sits in the RingCentral fax client inside OpenEMR's fax and SMS module. According to the vulnerability record, the disposeDocument() method fails to check the file path it is given, so an authenticated attacker can pass a crafted path and read or overwrite arbitrary files. Using a download action, an attacker can read credentials and source code; using a setup action with encoded content, they can write web-executable files and run code on the server.

Patient data at risk

The flaw affects every OpenEMR version before 8.3.0. Because the software stores patient records, a successful attack could expose sensitive health information. The vulnerability is classed as CWE-73, external control of a file name or path. No exploitation in the wild has been reported, and the flaw is not listed in CISA's known exploited vulnerabilities catalogue.

Upgrade to OpenEMR 8.3.0

OpenEMR 8.3.0 is the fixed release, and clinics and hospitals running earlier versions should upgrade without delay. No workaround has been published. Administrators should also review server logs for suspicious fax-module activity and rotate any credentials that may have been exposed.

The flaw was reported by researcher nglong05 and published by VulnCheck. It is one of several OpenEMR fax-module flaws disclosed on the same day, underlining the need for health IT teams to keep the software current.