SB2026081526 - Multiple vulnerabilities in OpenEMR

Description

This security bulletin contains information about 2 vulnerabilities.

1) Files or Directories Accessible to External Parties (CVE-ID: CVE-2026-65983)

CWE-ID: CWE-552 - Files or Directories Accessible to External Parties

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to files or directories accessible to external parties in SignalWireClient::uploadFileForFax() in the oe-module-faxsms FaxSMS module when staging decrypted patient documents in a web-accessible directory and returning a public media URL. A remote attacker can fetch a staged document directly over HTTP to disclose sensitive information.

The staged file contains plaintext patient document data, remains on disk indefinitely, and the filename is derived from uniqid().

2) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 6.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to path traversal in interface/code_systems/standard_tables_manage.php and temp_dir_cleanup() when processing the db GET parameter. A remote privileged user can supply a crafted traversal sequence to delete arbitrary directories and cause a denial of service.

Exploitation through a chained attack can require tricking a superuser into visiting a crafted URL in their session context.

Remediation

Install update from vendor's website.

References

• https://github.com/openemr/openemr/security/advisories/GHSA-vv5j-6gjw-ffx9
• https://github.com/openemr/openemr/security/advisories/GHSA-hj9x-33vw-5g3x