OpenEMR Fax/SMS Module Path Traversal Allows Remote Code Execution

OpenEMR versions before 8.3.0 are affected by a broken access control and path traversal vulnerability in the fax/sms module's disposeDocument action, caused by an unvalidated file_path parameter.

An authenticated low-privilege user can exploit this flaw to read sqlconf.php and recover database credentials, and to write arbitrary files as the web user.

• Affected versions: OpenEMR before 8.3.0
• Prerequisite: authenticated low-privilege user
• Impact: database credential disclosure and remote code execution