HIGH 7.1 NVD
CVE-2026-124479
OpenEMR before 8.4.0 contains an arbitrary local file read vulnerability in REST document download, where the controller passes stored uploaded document bytes t
OpenEMR before 8.4.0 contains an arbitrary local file read vulnerability in REST document download, where the controller passes stored uploaded document bytes to Symfony's BinaryFileResponse as a filesystem path instead of returning them as content. Authenticated users with document upload and download access can upload a document containing an absolute pathname, such as the sqlconf.php location, then download it to read server files and recover database credentials.
References
- https://github.com/openemr/openemr/security/advisories/GHSA-xgxv-36g2-hq5g
- https://www.vulncheck.com/advisories/openemr-before-8.4.0-arbitrary-file-read-via-rest-doc
This high severity vulnerability with a CVSS score of 7.1 was published on 2026-11-08 via NVD.
vulnfeed aggregates 16937 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.