CVE-2026-24848CRITICAL 9.9EPSS p53.1%

CVE-2026-24848CVE-2026-24848

Description

OpenEMR is a free and open source electronic health records and medical practice management application. In 7.0.4 and earlier, the disposeDocument() method in EtherFaxActions.php allows authenticated users to write arbitrary content to arbitrary locations on the server filesystem. This vulnerability can be exploited to achieve Remote Code Execution (RCE) by uploading malicious PHP web shells.

Scoring

CVSS 3.19.9 (CRITICAL)
VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS0.84% probability of exploitation · percentile 53.1% · 2026-06-19T12:03:05Z
Published2026-03-03
Last modified2026-03-04

Underlying weaknesses· 1

CWE-22

References

  1. https://github.com/openemr/openemr/security/advisories/GHSA-5vp5-4rm6-h4c9

1

TypeTargetConfidenceTier
WeaknessImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal')cwe-220%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2026-32238
CVE
CVE-2026-33301
CVE
CVE-2026-33918
CVE
CVE-2026-24898
CVE
CVE-2026-33346
CVE
CVE-2026-34053
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.