CVE-2018-1000645

Name of the Vulnerable Software and Affected Versions LibreHealthIO lh-ehr versions prior to 2.0.0

Description The issue allows for local file disclosure, which can result in the disclosure of sensitive files on the server. This is exploitable via a user-controlled variable in the import templates function.

Recommendations For versions prior to 2.0.0, update to version 2.0.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the import templates function to minimize the risk of exploitation.