CVE-2026-124479
Received Received - Intake

Arbitrary Local File Read in OpenEMR REST API

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
OpenEMR before 8.4.0 contains an arbitrary local file read vulnerability in REST document download, where the controller passes stored uploaded document bytes to Symfony's BinaryFileResponse as a filesystem path instead of returning them as content. Authenticated users with document upload and download access can upload a document containing an absolute pathname, such as the sqlconf.php location, then download it to read server files and recover database credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-124479
EUVD
EUVD-2026-119534

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openemr openemr to 8.4.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenEMR before version 8.4.0 has a flaw where authenticated users with document upload and download permissions can exploit a REST document download feature to read arbitrary local files on the server. The vulnerability occurs because the system passes a user-controlled file path directly to Symfony's BinaryFileResponse instead of returning file content, allowing attackers to specify absolute paths like sqlconf.php to access sensitive files and database credentials.

Detection Guidance

Check OpenEMR version for versions before 8.4.0. Review REST document download logs for unusual file paths or absolute pathnames in requests. Inspect uploaded documents for embedded absolute paths.

Impact Analysis

If you use OpenEMR versions before 8.4.0, an attacker with document upload and download access could read sensitive server files, including configuration files like sqlconf.php, exposing database credentials and other critical system information. This could lead to further attacks, data breaches, or unauthorized access to patient or user data.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by exposing sensitive personal data, such as patient records or credentials, through unauthorized file access. GDPR requires protecting personal data, and HIPAA mandates safeguarding protected health information. A breach could result in legal penalties, fines, and reputational damage.

Mitigation Strategies

Upgrade OpenEMR to version 8.4.0 or later immediately. Restrict document upload permissions to trusted users only. Monitor file access logs for suspicious download attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-124479. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...