CVE-2026-24849
Published: 25 February 2026
Summary
CVE-2026-24849 is a critical-severity Path Traversal (CWE-22) vulnerability in Open-Emr Openemr. Its CVSS base score is 9.9 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked in the top 20.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-24849 affects OpenEMR, a free and open source electronic health records and medical practice management application. Prior to version 7.0.4, the `disposeDocument()` method in `EtherFaxActions.php` suffers from a path traversal vulnerability (CWE-22) that enables arbitrary file reads from the server filesystem. The vulnerability has a CVSS v3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting its critical severity due to network accessibility, low attack complexity, and broad impact potential.
Any authenticated user, regardless of privilege level, can exploit this vulnerability remotely without user interaction. By invoking the flawed `disposeDocument()` method, attackers gain the ability to read sensitive files from the server filesystem, such as configuration files, patient data, or other restricted resources, potentially compromising confidentiality and enabling further attacks.
OpenEMR version 7.0.4 addresses the issue with a patch. Additional details are available in the GitHub security advisory at https://github.com/openemr/openemr/security/advisories/GHSA-w6vc-hx2x-48pc and the specific commit at https://github.com/openemr/openemr/commit/22f8e53e5769a88b7a16cb223bd197d044c84e5a.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-8581
Vulnerability details
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 7.0.4, the `disposeDocument()` method in `EtherFaxActions.php` allows authenticated users to read arbitrary files from the server filesystem. Any authenticated user (regardless of…
more
privilege level) can exploit this vulnerability to read sensitive files. Version 7.0.4 patches the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal enables direct arbitrary file reads from the local filesystem (T1005 Data from Local System), including configuration files that commonly contain credentials (T1552.001 Credentials In Files).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates path traversal (CWE-22) in disposeDocument() by validating file path inputs to prevent arbitrary file reads.
Enforces logical access authorizations to block authenticated users from reading unauthorized server filesystem files via the flawed method.
Requires timely flaw remediation, such as applying the OpenEMR 7.0.4 patch that fixes the vulnerability.