CVE-2026-24849: critical vulnerability in openemr
OpenEMR Arbitrary File Read Vulnerability
Published
48Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 10epss 2.3%
from disclosure to weapon101 days
Published on NVDFeb 25
1st PoC+101d
exploitation probability
2.3%top 17% of all CVEs
observed exploitation
nono source reports it
2 public exploit(s)
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 7.0.4, the `disposeDocument()` method in `EtherFaxActions.php` allows authenticated users to read arbitrary files from the server filesystem. Any authenticated user (regardless of privilege level) can exploit this vulnerability to read sensitive files. Version 7.0.4 patches the issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
openemr · openemrpublic PoCs found — 2
exploitdbwww.exploit-db.com/exploits/52610unverifiedgithubgithub.com/doany1/CVE-2026-24849★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — openemr
In the same product, most dangerous first.
CVE-2025-31121HIGHOpenEMR allows XSS in Patient Image featureEPSS 17.3%CVE-2025-43860HIGHOpemEMR Vulnerable to Stored XSS Attack in the Additional Address Section of Patient DemographicsEPSS 14.4%CVE-2025-30161HIGHOpenEMR Stored XSS in OpenEMR Bronchitis FormEPSS 10.9%CVE-2025-32794HIGHOpenEMR Stored XSS via Patient Name Field in Procedure OrdersEPSS 10.1%CVE-2026-24848HIGHOpenEMR Arbitrary File Write leading to Remote Code ExecutionEPSS 6.6%CVE-2025-69231HIGHOpenEMR has a Stored XSS in GAD-7 Form that Enables Session Hijacking and Privilege EscalationEPSS 3.8%