CVE-2026-24849 - Vulnerability Analysis

Overview

OpenEMR < 7.0.4 contains a file system read vulnerability caused by improper access control in disposeDocument() method in EtherFaxActions.php, letting authenticated users read arbitrary files, exploit requires authentication.

Severity & Score

Impact

Authenticated users can read sensitive files on the server, potentially exposing confidential information.

Mitigation

Update to version 7.0.4 or later.

References

• https://github.com/openemr/openemr/commit/22f8e53e5769a88b7a16cb223bd197d044c84e5a
• https://github.com/openemr/openemr/security/advisories/GHSA-w6vc-hx2x-48pc

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Feb 25, 2026

🔴 CVE-2026-24849 - Critical (9.9) OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 7.0.4, the `disposeDocument()` method in `EtherFaxActions.php` allows authenticated users to read arbitrary files from th... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24849/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner