What is CVE-2026-24848?

CVE-2026-24848 is a critical-severity vulnerability in Open-emr Openemr, classified under Path Traversal. CVSS score: 9.9/10. Published 2026-03-03.

How severe is CVE-2026-24848?

Critical severity. CVSS v3 base score is 9.9 out of 10.

Path Traversal in Open-emr Openemr

CVE-2026-24848

OpenEMR is a free and open source electronic health records and medical practice management application. In 7.0.4 and earlier, the disposeDocument() method in EtherFaxActions.php allows authenticated users to write arbitrary content to arb…

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.068 (93.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.

Affected products

Open-emr Openemr
Openemr — versions <= 7.0.4

Weakness classification (CWE)

CWE-22 — Path Traversal

References

security-advisories@github.com (x_refsource_CONFIRM, Exploit, Mitigation, Vendor Advisory)

Frequently asked questions

What is CVE-2026-24848?: CVE-2026-24848 is a critical-severity vulnerability in Open-emr Openemr, classified under Path Traversal. CVSS score: 9.9/10. Published 2026-03-03.
How severe is CVE-2026-24848?: Critical severity. CVSS v3 base score is 9.9 out of 10.