OpenEMR Path Traversal in FaxSMS Module Exposes Credentials

OpenEMR versions prior to 8.3.0 contain a critical path traversal vulnerability in the FaxSMS module's document handling functions that allows authenticated low-privilege users to bypass file access controls. By manipulating the unsanitized file_path parameter in RCFaxClient and SignalWireClient's disposeDocument functions, attackers can read arbitrary files from the server—including sensitive database configuration files like sqlconf.php containing cleartext credentials and encryption keys. This vulnerability is particularly dangerous because it requires only low-privilege authentication, meaning any user with basic access to OpenEMR can exploit it. Healthcare organizations running affected versions face immediate risk of credential compromise, database exposure, and potential lateral movement within their infrastructure.

While this CVE currently has no mapped MITRE ATT&CK techniques, Casky's security skills powered by Claude AI would detect the underlying attack patterns through behavioral analysis of file system access anomalies. Practitioners using Casky would identify suspicious patterns consistent with CWE-73 (External Control of File Name or Path) including: unexpected traversal sequences in file parameters, attempts to access files outside intended directories, privilege escalation indicators through configuration file access, and credential extraction patterns targeting database configuration. The platform's 754 security skills would correlate these signals across your environment—flagging authenticated sessions making unusual file requests, detecting when low-privilege accounts access high-sensitivity files like sqlconf.php, and alerting on patterns matching the disposeDocument function exploitation. Practitioners would receive findings highlighting the attack chain: initial authentication, parameter manipulation attempts, and file exfiltration activities that deviate from normal FaxSMS module behavior.