OpenEMR Arbitrary File Read Vulnerability

An attacker exploiting this vulnerability can leverage their authenticated user account to read any file accessible by the web server process. This includes configuration files, database credentials, patient records, and other sensitive data. The impact is significant, as it allows for complete exposure of the server's filesystem to a privileged user. Successful exploitation could lead to data exfiltration, system compromise, and regulatory non-compliance, particularly concerning protected health information (PHI). This vulnerability shares similarities with other file access vulnerabilities where improper input validation allows attackers to manipulate file paths.

Healthcare providers and organizations utilizing OpenEMR, particularly those with legacy configurations or shared hosting environments, are at significant risk. Any deployment where user authentication is in place and file system permissions are not strictly controlled is vulnerable. Organizations relying on OpenEMR to manage sensitive patient data are especially at risk due to potential HIPAA violations.

• php / server:

grep -r 'disposeDocument\(\)' /var/www/openemr/src/classes/EtherFaxActions.php

• generic web:

curl -I http://<openemr_server>/openemr/EtherFaxActions.php?disposeDocument=../../../../etc/passwd

• linux / server:

journalctl -u apache2 -f | grep 'disposeDocument'

1. 2026-02-25Disclosure

   disclosure

1. Réservé2026-01-27
2. Publiée2026-02-25
3. EPSS mis à jour2026-03-23

The primary mitigation is to immediately upgrade OpenEMR to version 7.0.4 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict file system permissions for the web server user to the absolute minimum required for OpenEMR operation. Implement a Web Application Firewall (WAF) with rules to block requests containing suspicious file paths or attempts to access files outside of designated directories. Monitor access logs for unusual file access patterns, particularly requests targeting sensitive file extensions or locations. After upgrading, confirm the fix by attempting to access a known sensitive file via the vulnerable endpoint – access should be denied.