OpenEMR versions prior to 8.4.0 contain a local file inclusion flaw in the ESign router module. Unsanitized input from the 'module' parameter is passed directly into a require_once that reaches to '<module>/Controller.php'. The fax upload feature writes attacker‑controlled files to a predictable temporary location without validating extensions or names. An authenticated user can therefore upload a file named Controller.php, craft a request to interface/esign/index.php with a traversing value for the module parameter, and force the application to include the malicious file, enabling arbitrary PHP code execution. The flaw grants the attacker full code execution privileges within the web server context and can compromise confidentiality, integrity, and availability of the underlying system. The CVSS base score of 8.7 confirms the severity of this exploitation.

Impacting all OpenEMR deployments running a version older than 8.4.0. The modification applies to the core OpenEMR product provided by the openemr vendor. No specific build numbers are listed, so any installation built before the 8.4.0 release is considered vulnerable. Organizations should verify the installed OpenEMR version and assess whether the vulnerable fax upload or ESign functionality remains enabled.

With a CVSS score of 8.7 the vulnerability is classified as high severity, and it is not yet tracked in the CISA KEV catalog. Since the attack requires authentication and an ability to upload files, the risk is mitigated by limiting those privileges. However, once the permissions are available the exploitation path is straightforward due to the lack of input validation and directory traversal protection. An attacker can then execute arbitrary PHP code, potentially taking over the web application or the entire host, depending on the server's configuration. Monitoring for unusual file uploads and access patterns remains a useful defensive technique until a patch is applied.