CVE-2026-124479: openemr: OpenEMR before 8.4.0 contains an arbitrary local file read vulnerability in REST document download, where the…

OpenEMR before 8.4.0 contains an arbitrary local file read vulnerability in REST document download, where the controller passes stored uploaded document bytes to Symfony's BinaryFileResponse as a filesystem path instead of returning them as content. Authenticated users with document upload and...