CVE-2026-124479: OpenEMR before 8.4.0 Arbitrary File Read via REST Document Download

Published Nov 8, 2026

Updated

OpenEMR before 8.4.0 contains an arbitrary local file read vulnerability in REST document download, where the controller passes stored uploaded document bytes to Symfony's BinaryFileResponse as a filesystem path instead of returning them as content. Authenticated users with document upload and download access can upload a document containing an absolute pathname, such as the sqlconf.php location, then download it to read server files and recover database credentials.

Event History

Nov 8, 2026

CVE Published

via MITRE·01:15 PM

Data Sourced

via MITRE·01:15 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which users can exploit this issue?

An authenticated user needs both document upload and document download access. The issue is exposed through the REST document-download functionality.

What does an attacker need to do to read a server file?

The attacker can upload a document whose contents are an absolute filesystem pathname, then download that document through the affected REST endpoint. The response handling treats those uploaded bytes as a path and may return the referenced local file.

What is the likely impact of successful exploitation?

An attacker can read arbitrary local files accessible to the OpenEMR process. The provided example is reading sqlconf.php to recover database credentials.

What should be prioritized for remediation?

Upgrade OpenEMR to version 8.4.0 or later. Until upgrading, restrict document upload and download permissions to trusted users because those permissions are required for exploitation.

CVE-2026-124479: OpenEMR before 8.4.0 Arbitrary File Read via REST Document Download

Event History

Frequently Asked Questions

Which users can exploit this issue?

What does an attacker need to do to read a server file?

What is the likely impact of successful exploitation?

What should be prioritized for remediation?

Company

Resources

Contact

Frequently Asked Questions

Which users can exploit this issue?

What does an attacker need to do to read a server file?

What is the likely impact of successful exploitation?

What should be prioritized for remediation?