OpenEMR versions before 7.0.4 are vulnerable to an arbitrary file read flaw that lets any authenticated user — even a low-privilege receptionist account — read files the web server can access, including database credentials in sqlconf.php or system files like /etc/passwd.
The vulnerability, tracked as CVE-2026-24849 and classified under CWE-22 (Path Traversal), sits in the Fax/SMS module’s EtherFaxActions::disposeDoc() method. It takes a user-supplied file_path parameter and passes it directly to readfile() with no path validation. The method never calls authenticate(), so only a valid OpenEMR session is needed.
Discovered by researcher doany1 and published on June 6, 2026, the bug requires the Fax/SMS module to be enabled with EtherFax selected as the provider — though a real EtherFax account isn’t necessary.
There’s a nasty twist: disposeDoc() calls unlink() on the target file after reading it. That means if the web server user has delete permission on the target, the file gets destroyed in the process. Testers are advised to use root-owned files like /etc/passwd where the unlink will fail.
OpenEMR is widely used in healthcare settings. Administrators should upgrade to version 7.0.4 or later immediately.
