{"api_version":"1","generated_at":"2026-11-07T20:24:11+00:00","cve":"CVE-2026-65983","urls":{"html":"https://cve.report/CVE-2026-65983","api":"https://cve.report/api/cve/CVE-2026-65983.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-65983","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-65983"},"summary":{"title":"OpenEMR FaxSMS module: insecure staging of decrypted patient documents in webroot","description":"OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.2.0, interface/modules/custom_modules/oe-module-faxsms/src/Controller/SignalWireClient.php decrypts a selected patient document with Document::get_data() and SignalWireClient::uploadFileForFax() writes the plaintext bytes under sites/{siteId}/fax. The module returns the resulting public URL to SignalWire, protects it only with a predictable uniqid() filename, and never removes the staged file. An unauthenticated network actor who obtains or guesses the URL can retrieve persistent patient documents even when drive encryption is enabled. This issue is fixed in version 8.2.0.","state":"PUBLISHED","assigner":"GitHub_M","published_at":"2026-11-05 20:17:59","updated_at":"2026-11-06 21:29:48"},"problem_types":["CWE-200","CWE-552","CWE-552 CWE-552: Files or Directories Accessible to External Parties","CWE-200 CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"],"metrics":[{"version":"3.1","source":"security-advisories@github.com","type":"Secondary","score":"7.5","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.5","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}}],"references":[{"url":"https://github.com/openemr/openemr/security/advisories/GHSA-vv5j-6gjw-ffx9","name":"https://github.com/openemr/openemr/security/advisories/GHSA-vv5j-6gjw-ffx9","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/openemr/openemr/pull/12766","name":"https://github.com/openemr/openemr/pull/12766","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/openemr/openemr/commit/406bb7015e894c243936b0817d7c7060686a13d9","name":"https://github.com/openemr/openemr/commit/406bb7015e894c243936b0817d7c7060686a13d9","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/openemr/openemr/releases/tag/v8_2_0","name":"https://github.com/openemr/openemr/releases/tag/v8_2_0","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-65983","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65983","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"openemr","product":"openemr","version":"affected < 8.2.0","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"65983","cve":"CVE-2026-65983","epss":"0.001920000","percentile":"0.089730000","score_date":"2026-11-06","updated_at":"2026-11-07 00:05:35"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"product":"openemr","vendor":"openemr","versions":[{"status":"affected","version":"< 8.2.0"}]}],"descriptions":[{"lang":"en","value":"OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.2.0, interface/modules/custom_modules/oe-module-faxsms/src/Controller/SignalWireClient.php decrypts a selected patient document with Document::get_data() and SignalWireClient::uploadFileForFax() writes the plaintext bytes under sites/{siteId}/fax. The module returns the resulting public URL to SignalWire, protects it only with a predictable uniqid() filename, and never removes the staged file. An unauthenticated network actor who obtains or guesses the URL can retrieve persistent patient documents even when drive encryption is enabled. This issue is fixed in version 8.2.0."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-552","description":"CWE-552: Files or Directories Accessible to External Parties","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-200","description":"CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-05T19:52:57.438Z","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M"},"references":[{"name":"https://github.com/openemr/openemr/security/advisories/GHSA-vv5j-6gjw-ffx9","tags":["x_refsource_CONFIRM"],"url":"https://github.com/openemr/openemr/security/advisories/GHSA-vv5j-6gjw-ffx9"},{"name":"https://github.com/openemr/openemr/pull/12766","tags":["x_refsource_MISC"],"url":"https://github.com/openemr/openemr/pull/12766"},{"name":"https://github.com/openemr/openemr/commit/406bb7015e894c243936b0817d7c7060686a13d9","tags":["x_refsource_MISC"],"url":"https://github.com/openemr/openemr/commit/406bb7015e894c243936b0817d7c7060686a13d9"},{"name":"https://github.com/openemr/openemr/releases/tag/v8_2_0","tags":["x_refsource_MISC"],"url":"https://github.com/openemr/openemr/releases/tag/v8_2_0"}],"source":{"advisory":"GHSA-vv5j-6gjw-ffx9","discovery":"UNKNOWN"},"title":"OpenEMR FaxSMS module: insecure staging of decrypted patient documents in webroot"}},"cveMetadata":{"assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","assignerShortName":"GitHub_M","cveId":"CVE-2026-65983","datePublished":"2026-11-05T19:52:57.438Z","dateReserved":"2026-07-23T18:54:15.832Z","dateUpdated":"2026-11-05T19:52:57.438Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-05 20:17:59","lastModifiedDate":"2026-11-06 21:29:48","problem_types":["CWE-200","CWE-552","CWE-552 CWE-552: Files or Directories Accessible to External Parties","CWE-200 CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"65983","Ordinal":"1","Title":"OpenEMR FaxSMS module: insecure staging of decrypted patient doc","CVE":"CVE-2026-65983","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"65983","Ordinal":"1","NoteData":"OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.2.0, interface/modules/custom_modules/oe-module-faxsms/src/Controller/SignalWireClient.php decrypts a selected patient document with Document::get_data() and SignalWireClient::uploadFileForFax() writes the plaintext bytes under sites/{siteId}/fax. The module returns the resulting public URL to SignalWire, protects it only with a predictable uniqid() filename, and never removes the staged file. An unauthenticated network actor who obtains or guesses the URL can retrieve persistent patient documents even when drive encryption is enabled. This issue is fixed in version 8.2.0.","Type":"Description","Title":"OpenEMR FaxSMS module: insecure staging of decrypted patient doc"}]}}}