The vulnerability allows an authenticated user to specify any file path in the fax sending endpoint, which the application then streams directly to a fax gateway. This results in the attacker being able to read and send any file on the server—including database credentials, patient documents, system files, and source code—to an external phone number, thereby compromising confidentiality. The weakness is a classic path traversal flaw, classified as CWE-22.

The flaw exists in OpenEMR versions up to and including 8.0.0. Users running any of those releases are potentially exposed; no patched releases are currently available.

Based on the CVSS score of 6.5, the vulnerability carries moderate severity. The EPSS score is below 1%, suggesting a low likelihood of exploitation in the near term. The failure is not listed in the CISA KEV catalog, so there is no evidence of active exploitation. The attack vector requires the attacker to be an authenticated user, so the adversary must first compromise user credentials or gain legitimate access to the system. Once authenticated, the attacker can exploit the fax endpoint to exfiltrate any filepath supplied.