CVE-2026-124467OpenEMR before 8.4.0 Remote Code Execution via ESign LFI and fax upload

Descripción

OpenEMR before 8.4.0 contains a local file inclusion in the ESign router (library/ESign/Router.php), which passes the unsanitized module parameter into a require_once of '<module>/Controller.php', and the fax module's faxProcessUploads writes attacker-named files to a predictable temp path without extension checks. Authenticated attackers can upload a PHP file named Controller.php, then request interface/esign/index.php with a traversing module parameter to include it and execute arbitrary code.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• GitHub Security Advisory (GHSA-p4v7-crwp-qq7q) vendor-advisory
• VulnCheck Advisory: OpenEMR before 8.4.0 Remote Code Execution via ESign LFI and fax upload third-party-advisory