PT-2026-21824 · Openemr · Openemr

Tonghuaroot · Published 2026-02-25 · Updated 2026-03-02 · CVE-2026-24849

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 7.0.4

Description OpenEMR is an open source electronic health records and medical practice management application. Prior to version 7.0.4, the disposeDocument() method in EtherFaxActions.php allows authenticated users to read arbitrary files from the server filesystem. Any authenticated user, regardless of privilege level, can exploit this to read sensitive files. The disposeDocument() function is vulnerable.

Recommendations Update to version 7.0.4.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-24849

GHSA-W6VC-HX2X-48PC

Affected Products

Openemr

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24849.json · Exploit
• https://github.com/openemr/openemr/security/advisories/GHSA-w6vc-hx2x-48pc · Vendor Advisory
• https://github.com/openemr/openemr/commit/22f8e53e5769a88b7a16cb223bd197d044c84e5a · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-24849 · Security Note
• https://osv.dev/vulnerability/CVE-2026-24849 · Vendor Advisory
• https://twitter.com/cracbot/status/2028425178984915276 · Twitter Post
• https://twitter.com/pulsepatchio/status/2027033969070342244 · Twitter Post
• https://twitter.com/CveFindCom/status/2026487673003581908 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2026619733735342320 · Twitter Post
• https://twitter.com/CVEnew/status/2026641386678718924 · Twitter Post
• https://twitter.com/CveTodo/status/2026485430896468457 · Twitter Post