CVE-2026-124467

OpenEMR before 8.4.0 contains a local file inclusion in the ESign router library/ESign/Router.php, which passes the unsanitized module parameter into a requireonce of '/Controller.php', and the fax module's faxProcessUploads writes attacker-named files to a predictable temp path without extension...