# CVE-2026-124450

Auth low-priv OpenEMR path traversal allows DB credential theft and remote code execution

- Page: https://www.vulneraibility.com/cve/CVE-2026-124450
- CVSS: 9.3
- Known exploited: not in CISA KEV as of our last sync
- Weakness: CWE-73
- Also known as: GHSA-wf4w-mx2w-j4vv
- Published: 2026-11-08

## Affected versions

- openemr: affected < 8.3.0; fixed in 8.3.0

A version outside these ranges is not a statement that it is unaffected.

## Impact

Authenticated low-priv user can read sqlconf.php to obtain DB creds, write files as web user, enabling remote code execution and data exfiltration.

## Action

Immediate action required

## Recommendation

Upgrade to OpenEMR 8.3.0 or apply vendor patch; rotate DB credentials and restrict fax/sms access

## References

- [advisory] https://github.com/openemr/openemr/security/advisories/GHSA-wf4w-mx2w-j4vv
- [advisory] https://www.vulncheck.com/advisories/openemr-before-8.3.0-arbitrary-file-read-write-via-disposedocument

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.