The vulnerability arises in the disposeDocument() method of EtherFaxActions.php in OpenEMR versions 7.0.4 and earlier. The method fails to properly validate file paths, allowing an authenticated user to write arbitrary content to any location on the server filesystem. This flaw is classified as CWE‑22 and can be leveraged to deploy malicious PHP shells, resulting in full remote code execution on the host machine.

The affected product is OpenEMR OpenEMR. Versions 7.0.4 and earlier are impacted. Users running these releases should verify their installed version against this list.

This vulnerability has a CVSS score of 8.7, indicating a high severity. The EPSS score is less than 1%, implying a low exploitation probability at the time of analysis, and the issue is not listed in the CISA KEV catalog. The likely attack requires an authenticated session within the application, enabling an attacker to supply path strings that escape the intended directory boundary and upload executable PHP code. Once such a file is placed on disk, it can be accessed through the web interface to trigger arbitrary code on the server.