OpenEMR Unvalidated Path Traversal Enables Credential Theft

CVE-2026-124450 is a critical broken access control vulnerability affecting OpenEMR versions prior to 8.3.0 in the fax/sms module's disposeDocument action. The vulnerability stems from an unvalidated file_path parameter that allows authenticated low-privilege users to traverse the file system and access sensitive files like sqlconf.php, which contains database credentials in plaintext. Healthcare organizations using OpenEMR are particularly at risk, as compromise of database credentials can lead to exposure of protected health information (PHI) and patient privacy violations. The attack requires valid authentication but no elevated privileges, making it accessible to any user account—including support staff, contractors, or compromised low-level accounts—significantly broadening the threat surface.

While MITRE ATT&CK techniques are not officially mapped to this CVE, practitioners using Casky.ai would identify attack patterns consistent with T1083 (File and Directory Discovery), T1005 (Data from Local System), and T1190 (Exploit Public-Facing Application). The platform's extended reasoning capabilities would flag suspicious file path traversal patterns in web requests targeting the disposeDocument endpoint, detect attempts to access files outside intended directories (especially configuration files like sqlconf.php), and identify sequential file read operations followed by write attempts as indicators of reconnaissance and code execution stages. Security teams would see findings highlighting the progression from low-privilege access through lateral movement toward RCE, enabling detection before full system compromise and allowing remediation through immediate patching to version 8.3.0 or later.