CVE-2026-24849
CRITICALOpenEMR < 7.0.4 - Authenticated Path Traversal via EtherFaxActions.php disposeDocument()
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2026-24849. PoCs published by doany1.
AI-analyzed exploit summary This exploit demonstrates an authenticated arbitrary file read vulnerability in OpenEMR < 7.0.4 via the Fax/SMS module's EtherFaxActions::disposeDoc() method, which passes a user-supplied file_path parameter directly to readfile() without validation. The exploit includes authentication handling and file read functionality, with a warning about the destructive unlink() call post-read.
Description
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 7.0.4, the `disposeDocument()` method in `EtherFaxActions.php` allows authenticated users to read arbitrary files from the server filesystem. Any authenticated user (regardless of privilege level) can exploit this vulnerability to read sensitive files. Version 7.0.4 patches the issue.
Exploits (2)
This exploit demonstrates an authenticated arbitrary file read vulnerability in OpenEMR < 7.0.4 via the Fax/SMS module's EtherFaxActions::disposeDoc() method, which passes a user-supplied file_path parameter directly to readfile() without validation. The exploit includes authentication handling and file read functionality, with a warning about the destructive unlink() call post-read.
This repository contains a functional Python exploit for CVE-2026-24849, an authenticated arbitrary file read vulnerability in OpenEMR's Fax/SMS module. The exploit demonstrates the vulnerability by reading arbitrary files from the server filesystem as the web-server user.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H