OpenEMR FaxSMS module: insecure staging of decrypted patient documents in webroot

published 2026-11-05 3 d ago modified 2026-11-06 2 d ago also EUVD-2026-117762

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 8%
public exploits: 0; none known

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.2.0, interface/modules/custom_modules/oe-module-faxsms/src/Controller/SignalWireClient.php decrypts a selected patient document with Document::get_data() and SignalWireClient::uploadFileForFax() writes the plaintext bytes under sites/{siteId}/fax. The module returns the resulting public URL to SignalWire, protects it only with a predictable uniqid() filename, and never removes the staged file. An unauthenticated network actor who obtains or guesses the URL can retrieve persistent patient documents even when drive encryption is enabled. This issue is fixed in version 8.2.0.

Patch / fix

links 3

github.com/openemr/openemr@406bb70 commit
github.com/openemr/openemr#12766 pull request
github.com/openemr/openemr/releases/tag/v8_2_0 release

Exploit prediction

0.19% chance of exploitation in the next 30 days, higher than 8% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

openemr openemr

Classification

Weakness

CWE-552 Files or Directories Accessible to External Parties
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

CVE List CVE-2026-65983
NVD CVE-2026-65983

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary