Threats tagged 'ghsa-cq78-6jw9-4cxm'

OpenEMR versions prior to 8.3.0 contain a critical vulnerability in the fax/sms module's disposeDocument action. This flaw involves broken access control and path traversal via an unvalidated file_path parameter. Authenticated users with low privileges can exploit this to read sensitive configuration files, including sqlconf.php, exposing database credentials. Additionally, attackers can write arbitrary files as the web user, potentially leading to remote code execution.