CVE-2026-65983

    Dashboard / Vulnerabilities / CVE-2026-65983

    CVE-2026-65983

    Published: 5 Nov 2026Last Modified: 8 Nov 2026

    Summary: OpenEMR FaxSMS module: insecure staging of decrypted patient documents in webroot

    Details: OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.2.0, interface/modules/custom_modules/oe-module-faxsms/src/Controller/SignalWireClient.php decrypts a selected patient document with Document::get_data() and SignalWireClient::uploadFileForFax() writes the plaintext bytes under sites/{siteId}/fax. The module returns the resulting public URL to SignalWire, protects it only with a predictable uniqid() filename, and never removes the staged file. An unauthenticated network actor who obtains or guesses the URL can retrieve persistent patient documents even when drive encryption is enabled. This issue is fixed in version 8.2.0.

    References: https://github.com/openemr/openemr/releases/tag/v8_2_0, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65983.json, https://github.com/openemr/openemr/security/advisories/GHSA-vv5j-6gjw-ffx9, https://nvd.nist.gov/vuln/detail/CVE-2026-65983, https://github.com/openemr/openemr/commit/406bb7015e894c243936b0817d7c7060686a13d9, https://github.com/openemr/openemr/pull/12766

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -6125a2fd8089c8bcc3848071c1293c60e27a7585

    Affected versions

    v3_0_1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-65983 | CVE-DB