The disclosure targets a flaw in the disposeDocument method of OpenEMR's EtherFaxActions.php, which permits any authenticated user to read files on the server irrespective of permission levels. This vulnerability allows attackers to obtain sensitive data such as configuration files, passwords, or patient information. It is a classic example of CWE‑22, where path traversal or improper validation enables unauthorized file access, resulting in a severe breach of confidentiality.

Vulnerable installations include OpenEMR versions prior to 7.0.4. The affected component is the disposeDocument method in EtherFaxActions.php, accessible to all authenticated users regardless of their role. Patching to OpenEMR 7.0.4 or later resolves the issue.

The flaw carries a maximum CVSS score of 10, indicating the ability to read any file without privilege escalation. However, the EPSS score is reported as less than 1%, suggesting a low probability of exploitation in the wild at present, and the vulnerability is not listed in the CISA KEV catalog. Attackers still need valid credentials, but because all authenticated users can exploit the flaw, the risk remains high if user accounts are compromised or weakly protected.