OpenEMR RingCentral Fax Client Path Traversal (CVE-2026-124490)

CVE-2026-124490 is a path-traversal flaw in disposeDocument(), a method of RCFaxClient, the RingCentral fax client inside OpenEMR's oe-module-faxsms module. An authenticated user can read and write arbitrary server files through an unvalidated file_path value. VulnCheck, the CNA, rates it CVSS 3.1 9.1 Critical.

The method takes the file path from the request, or from a stored session value, with no validation, then branches on a separate action value, according to the advisory. One branch reads a file back to the caller, and another decodes submitted content and writes it to that same unchecked path.

The advisory calls this a sibling bug to an earlier, already-patched flaw in OpenEMR's EtherFax client, which was hardened with its own authentication and path checks. The RingCentral client was not, per the advisory.

What CVE-2026-124490 Lets an Attacker Do

The advisory's prerequisites are the fax/sms module active, RingCentral set as the fax or SMS vendor, and a valid login session. It does not name a specific role or permission beyond that. A successful read can expose database credentials, environment files, cached authentication tokens and OpenEMR's own source code, according to the advisory.

The advisory says the write path can escalate to full system compromise if the attacker can land a file somewhere the web server will execute it. Its CVSS vector lists privileges required as High, though the advisory's own prerequisites describe only a valid login session, without naming a specific permission.

CVSS Score and CWE for CVE-2026-124490

VulnCheck scores CVE-2026-124490 as CVSS 3.1 9.1 Critical, with a secondary CVSS 4.0 score of 9.4 Critical; VulnCheck's own advisory page displays the 9.4 figure. The CVE record lists CWE-73 as the primary weakness, and OpenEMR's advisory also maps CWE-434, unrestricted upload of a dangerous file type.

What OpenEMR and CISA KEV Say About Exploitation

OpenEMR's advisory says 8.3.0 is the first fixed release, and every earlier release is affected. As of CISA's Known Exploited Vulnerabilities catalog version 2026.11.06, CVE-2026-124490 is not listed. The advisory and the CVE record do not state whether the flaw has been exploited.

The CVE record and OpenEMR's advisory both list every release before 8.3.0 as affected. OpenEMR 8.3.0 is the first patched release.

OpenEMR's advisory says the fix adds authentication and file-path checks to the RingCentral client's disposeDocument method. GHSA-38jw-pwgq-9hpj credits nglong05 as the reporter.

We recommend planning the version upgrade with our vulnerability management guide. Our CWE entry explains how weakness classes like this one are catalogued.

OpenEMR 8.3.0 also fixes a second, broader flaw we cover separately, CVE-2026-124450, which a different researcher reported across both the RingCentral and SignalWire fax clients. Sites running the fax/sms module should patch for both.