# CVE-2026-124490

Authenticated path traversal → file read/write and RCE in OpenEMR <8.3.0 (oe-module-faxsms).

- Page: https://www.vulneraibility.com/cve/CVE-2026-124490
- CVSS: 9.4
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.36% (percentile 29.7)
- Weakness: CWE-73
- Also known as: GHSA-38jw-pwgq-9hpj
- Published: 2026-11-08

## Affected versions

- openemr: affected < 8.3.0; fixed in 8.3.0

A version outside these ranges is not a statement that it is unaffected.

## Impact

Authenticated attacker can read arbitrary files (credentials, source) via action=download and write web‑executable files via action=setup to achieve remote code execution.

## Action

Immediate action required

## Recommendation

Upgrade to OpenEMR 8.3.0 or disable oe-module-faxsms; rotate exposed credentials and audit logs.

## References

- [advisory] https://github.com/openemr/openemr/security/advisories/GHSA-38jw-pwgq-9hpj
- [advisory] https://www.vulncheck.com/advisories/openemr-before-8.3.0-arbitrary-file-read-write-via-oe-module-faxsms-disposedocument

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.