Local File Inclusion Vulnerability in OpenEMR by OpenEMR

CVE-2026-124467

What is CVE-2026-124467?

OpenEMR versions prior to 8.4.0 are susceptible to a local file inclusion vulnerability in the ESign router component. This issue arises from the unsafe handling of the module parameter, which can be exploited by authenticated attackers to include arbitrary PHP files. Specifically, the fax module's faxProcessUploads function allows attackers to upload files named Controller.php to a predictable temporary path without proper extension checks. By manipulating the module parameter, an attacker can then execute arbitrary code through a crafted request to interface/esign/index.php, significantly compromising the application's security.

References