CVE-2026-124490

OpenEMR before 8.3.0 contains a path traversal vulnerability in the RingCentral RCFaxClient disposeDocument method of oe-module-faxsms that allows authenticated attackers to read and write arbitrary files via the filepath parameter. Attackers can use action=download to read credentials and source...