Threats tagged 'ghsa-wmj2-9cqm-wfcq'

OpenEMR versions prior to 8.3.0 have a path traversal vulnerability in the FaxSMS module's RCFaxClient and SignalWireClient disposeDocument functions. This flaw allows authenticated users with low privileges to read and overwrite arbitrary files by exploiting an unsanitized file_path parameter. Attackers can download sensitive files such as database credentials or overwrite writable files on the web server, potentially impacting confidentiality, integrity, and availability.