CVE-2026-124446 | OpenEMR up to 8.2.x FaxSMS module sqlconf.php file_path path traversal

A vulnerability classified as critical has been found in OpenEMR up to 8.2.x. The impacted element is the function RCFaxClient.disposeDocument/SignalWireClient.disposeDocument of the file sqlconf.php of the component FaxSMS module. Performing a manipulation of the argument file_path results in path traversal.

This vulnerability is cataloged as CVE-2026-124446. It is possible to initiate the attack remotely. There is no exploit available.

It is recommended to upgrade the affected component.VulDB Recent EntriesRead More