CVE-2026-124479

OpenEMR versions prior to 8.4.0 are vulnerable to an arbitrary local file read vulnerability within the REST document download functionality. The root cause is that the controller incorrectly passes stored uploaded document bytes to Symfony's BinaryFileResponse as a filesystem path rather than as...