CVE-2026-24849: Arbitrary File Access in OpenEMR

An attacker exploiting this vulnerability can leverage their authenticated user account to read any file accessible by the web server process. This includes configuration files, database credentials, patient records, and other sensitive data. The impact is significant, as it allows for complete exposure of the server's filesystem to a privileged user. Successful exploitation could lead to data exfiltration, system compromise, and regulatory non-compliance, particularly concerning protected health information (PHI). This vulnerability shares similarities with other file access vulnerabilities where improper input validation allows attackers to manipulate file paths.

1. Reserved2026-01-27
2. Published2026-02-25
3. EPSS updated2026-03-23

The primary mitigation is to immediately upgrade OpenEMR to version 7.0.4 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict file system permissions for the web server user to the absolute minimum required for OpenEMR operation. Implement a Web Application Firewall (WAF) with rules to block requests containing suspicious file paths or attempts to access files outside of designated directories. Monitor access logs for unusual file access patterns, particularly requests targeting sensitive file extensions or locations. After upgrading, confirm the fix by attempting to access a known sensitive file via the vulnerable endpoint – access should be denied.