OpenEMR FaxSMS module: insecure staging of decrypted patient documents in webroot

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.2.0, interface/modules/custom_modules/oe-module-faxsms/src/Controller/SignalWireClient.php decrypts a selected patient document with Document::get_data() and SignalWireClient::uploadFileForFax() writes the plaintext bytes under sites/{siteId}/fax. The module returns the resulting public URL to SignalWire, protects it only with a predictable uniqid() filename, and never removes the staged file. An unauthenticated network actor who obtains or guesses the URL can retrieve persistent patient documents even when drive encryption is enabled. This issue is fixed in version 8.2.0.

Etkilenen sürümler1 yazılım

Kaynaklar6 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…penemr/security/advisories/GHSA-vv5j-6gjw-ffx9 Diğer
• github.com/openemr/openemr/pull/12766 Diğer
• github.com/…ommit/406bb7015e894c243936b0817d7c7060686a13d9 Diğer
• github.com/openemr/openemr/releases/tag/v8_2_0 Diğer

Kayıt geçmişi

1. 5 Kas 2026 22:52Yayımlandı

İlgili açıklar

• 9,6 CVE-2026-102940OpenEMR'de belge yeniden atama işleminde eksik yazma yetki denetimi
• 5,3 CVE-2026-103021OpenEMR: Username Enumeration via Pre-Authentication User Settings Loading
• 5,3 CVE-2026-103020OpenEMR: Unauthenticated Information Disclosure in admin.php Exposes Database Names and Versions
• 4,3 CVE-2026-103019OpenEMR: Unauthenticated Open Redirect via OIDC End Session Endpoint
• 6,5 CVE-2026-104134OpenEMR: Missing authorization in person-search AJAX leaks patient demographics (name, DOB, phone, email)
• 5,4 CVE-2026-103939OpenEMR: Weno `file_download.php`: missing ACL/CSRF truncates the e-prescribing pharmacy directory