CVE-2026-24848 is a critical (CVSS 9.9) arbitrary file write in OpenEMR, in the disposeDocument method of the EtherFax module. Authenticated users can write files anywhere the web server can, which can lead to code execution. The record says 7.0.4 and earlier are affected. Upgrade after checking the advisory.
What's affected
The record says OpenEMR 7.0.4 and earlier are affected. The GitHub advisory's metadata box shows affected versions as below 7.0.4 and patched as 7.0.4, which does not line up with the description, so confirm the exact fixed release on the advisory and in OpenEMR's release notes before you decide you are covered.
The flaw is in the disposeDocument() method in EtherFaxActions.php, in the oe-module-faxsms module. The advisory says there is no permission check, no path validation, no content validation and no file type restriction, so any authenticated user, even with minimal privileges, can write content to arbitrary locations. Writing a PHP file into the web root leads to remote code execution.
How to check if you're exposed
Check your OpenEMR version in the application's about page, and check whether the fax and SMS module, oe-module-faxsms, is installed and enabled:
ls interface/modules/custom_modules/ | grep -i faxsms
If the module is not enabled, the vulnerable path is not in use, though you should still update. Look in the web root for PHP files you did not deploy.
For a quick look at your own dependencies, Safeguard's free in-browser dependency scan at https://gold.safeguard.sh/scan checks them against known CVEs in your browser.
What to do now
- Read the advisory and release notes, and upgrade to the newest OpenEMR release that includes the fix.
- Disable the EtherFax module if you do not use it.
- Search the web root and document folders for unexpected PHP files and investigate any you find.
- Review user accounts, since any authenticated user can reach the flaw. Remove unused ones.
- Make the web server user unable to write to code directories.
Why it matters
The weakness is CWE-22, improper limitation of a pathname to a restricted directory. The method takes a file path from the user and writes content to it, with no check that the path is safe. Combined with no restriction on file type, that is enough to place a script where the web server will run it.
OpenEMR holds patient health records, so the stakes for confidentiality are high, and healthcare regulators expect prompt patching. The advisory describes verification by the reporter, which is not evidence of attacks in the wild. The CVE is not in CISA's Known Exploited Vulnerabilities catalog.
Why file write flaws become code execution
Arbitrary file write is one of the shortest paths to remote code execution in web applications. If an attacker can choose both the location and the content of a file, and the server will execute files of that kind from that location, the job is done. PHP applications are especially exposed, since the web server runs any file with the right extension from the web root.
The advisory lists four missing controls for the vulnerable method: no permission check, no path validation, no content validation and no restriction on file type. Fixing any one of them would have reduced the risk. All four together make a very low bar.
What to look for on your server
Search the web root and document storage for PHP files with recent modification times that do not match your deployments. Check for new or changed accounts in OpenEMR and in the operating system. Review web server access logs for requests to the fax module's action routes by accounts that should not use fax.
Limit the damage of the next one
Run the web server as a user that cannot write to the application's code directories. Store uploaded documents outside the web root, and configure the server not to execute scripts from upload folders. Remove modules you do not use. The fax and SMS module is optional, so if nobody uses it, disable it.
Healthcare context
OpenEMR stores patient data, so a successful attack is more than a technical event. If you suspect the old version was exploited, involve your privacy and compliance people early and keep logs. Your breach assessment duties depend on your jurisdiction, so take advice from the people responsible for it.
Confirm the fix
Because the advisory's version fields disagree with the description, treat a version number alone as insufficient. After upgrading, confirm the fax module's action code now checks authorization and validates paths, by reading the release notes or the fix commit linked from the advisory.
Quick check
Which release fixes it?
The advisory metadata and the description disagree. Confirm the fixed release on the GitHub advisory and OpenEMR release notes.
Does it need a login?
Yes, an authenticated user, but the advisory says even minimal privileges are enough.
Sources
Last reviewed: 19 October 2026.
