CVE-2026-24488 in OpenEMR

摘要 (英语)

OpenEMR is a free and open source electronic health records and medical practice management application. In versions up to and including 8.0.0, an arbitrary file exfiltration vulnerability in the fax sending endpoint allows any authenticated user to read and transmit any file on the server (including database credentials, patient documents, system files, and source code) via fax to an attacker-controlled phone number. The vulnerability exists because the endpoint accepts arbitrary file paths from user input and streams them to the fax gateway without path restrictions or authorization checks. As of time of publication, no known patched versions are available.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

负责

GitHub_M

预定

2026-01-23

披露

2026-02-27

状态

已确认

条目

VulDB provides additional information and datapoints for this CVE:

标识符	漏洞	CWE	可利用	对策	CVE
348173	OpenEMR Fax Sending 目录遍历	22	未定义	未定义	CVE-2026-24488

来源

• MITRE
• NVD
• CVE Details