Threats tagged 'ghsa-jg97-vcwh-pc35'

OpenEMR versions prior to 8.4.0 have an arbitrary local file read vulnerability in the REST document download functionality. Authenticated users with document upload and download permissions can exploit this by uploading a document with an absolute file path, then downloading it to read sensitive server files such as database configuration files. This vulnerability allows unauthorized disclosure of sensitive information without impacting system integrity or availability.