Files or Directories Accessible to External Parties in OpenEMR - CVE-2026-65983
Published: August 15, 2026
Vulnerability identifier: #VU142670
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-65983
CWE-ID: CWE-552
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to files or directories accessible to external parties in SignalWireClient::uploadFileForFax() in the oe-module-faxsms FaxSMS module when staging decrypted patient documents in a web-accessible directory and returning a public media URL. A remote attacker can fetch a staged document directly over HTTP to disclose sensitive information.
The staged file contains plaintext patient document data, remains on disk indefinitely, and the filename is derived from uniqid().
Affected software
OpenEMR
How to mitigate CVE-2026-65983
Install security update from vendor's website.
OpenEMR - update to 8.2.0