An issue exists in OpenEMR prior to 5.0.1 Patch 7. Directory Traversal exists via docid=../ to /portal/lib/download_template.php.
open-emr openemr