OpenEMR versions prior to 8.3.0 contain a path traversal flaw in the FaxSMS module’s RCFaxClient and SignalWireClient disposeDocument functions. The unsanitized file_path parameter allows an authenticated user with low‑privilege rights to read any file on the system and to overwrite files writable by the web server, including sensitive configuration files such as sqlconf.php that expose database credentials. The vulnerability therefore enables both confidentiality compromise by exposing sensitive files and integrity compromise by allowing modification of server files.

The affected product is OpenEMR, version 8.2.x and earlier, identified by the vendor name openemr openemr. Any deployment of OpenEMR before version 8.3.0 is vulnerable.

The CVSS score of 8.7 marks the issue as high severity. An attacker must first authenticate with a low‑privilege user account; no unauthenticated exploitation is reported. Once authenticated, the attacker can request action=download to read arbitrary files or action=setup to overwrite writable files, potentially bypassing security controls. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the combination of high severity and the ability to read and write arbitrary files poses a significant risk if users grant credentials to malicious actors.