Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenEMR is a free and open source electronic health records and medical practice management application. In versions up to and including 8.0.0, an arbitrary file exfiltration vulnerability in the fax sending endpoint allows any authenticated user to read and transmit any file on the server (including database credentials, patient documents, system files, and source code) via fax to an attacker-controlled phone number. The vulnerability exists because the endpoint accepts arbitrary file paths from user input and streams them to the fax gateway without path restrictions or authorization checks. As of time of publication, no known patched versions are available.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-24488 OpenEMR Arbitrary File Exfiltration Vulnerability in Fax Sending Endpoint https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-24488
Post summary
The post announces a new OpenEMR vulnerability (CVE-2026-24488) that allows arbitrary file exfiltration via the fax sending endpoint.
CVE-2026-24488 OpenEMR is a free and open source electronic health records and medical practice management application. In versions up to and including 8.0.0, an arbitrary file exfi… https://www.cve.org/CVERecord?id=CVE-2026-24488
Post summary
The text simply references CVE-2026-24488 and links to the CVE record without providing additional details such as PoC, exploit, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | open-emr | openemr | - | - | - |