A broken access control and path traversal flaw in the fax/sms module’s disposeDocument action allows an authenticated low‑privilege user to pass an unvalidated file_path parameter. This enables the attacker to read files such as sqlconf.php, exposing database credentials, and to write arbitrary files as the web server user. The resulting ability to execute code on the server satisfies a remote code execution scenario. The weakness is identified as CWE-73.

OpenEMR versions prior to 8.3.0 are vulnerable. The affected product is the openemr:openemr suite, specifically any release newer than the initial launch but older than 8.3.0. No additional sub‑products are specified, so all standard deployments in this version range are impacted.

The CVSS score of 9.3 indicates a critical severity with a high likelihood of successful exploitation. The EPSS score is not available, so the precise probability of attack cannot be quantified, but the lack of access control combined with path traversal makes exploitation viable for attackers who can log in. The vulnerability is not listed in CISA KEV, but its high severity and potential impact warrant immediate attention. Attackers would need only a valid account with limited privileges in the fax/sms module to use the vulnerable disposeDocument action and gain remote code execution.