CVE-2026-24849 | OpenEMR is a free and open source electronic health records … | CVSS 10.0 CRITICAL

Description

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 7.0.4, the `disposeDocument()` method in `EtherFaxActions.php` allows authenticated users to read arbitrary files from the server filesystem. Any authenticated user (regardless of privilege level) can exploit this vulnerability to read sensitive files. Version 7.0.4 patches the issue.

Metadata

CVE ID: CVE-2026-24849
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-01-27 14:51 UTC
Published: 2026-02-25 01:44 UTC
Last updated: 2026-02-25 21:05 UTC
Primary CWE: CWE-22
CWE-22: Improper Limitation of a Pathname to a Restricted Di…
Vendor / Product: openemr / openemr
Sources: cve.org · NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: no
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
openemr	openemr	—	< 7.0.4

Weakness (CWE)

CWE	Source	Description
CWE-22	cna	CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSS scores (1)

Score	Severity	Version	Source	Vector
10.0	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References (2)

https://github.com/openemr/openemr/security/advisories/GHSA-w6vc-hx2x-48pc https://github.com/openemr/openemr/security/advisories/GHSA-w6vc-hx2x-48pc
https://github.com/openemr/openemr/commit/22f8e53e5769a88b7a16cb223bd197d044c84e5a https://github.com/openemr/openemr/commit/22f8e53e5769a88b7a16cb223bd197d044c84e5a