Authenticated file exfiltration via unrestricted fax path

Path traversal in OpenEMR 8.0.0 and earlier allows remote authenticated users to transmit arbitrary server files by fax. EtherFaxActions::sendFax accepts the user-controlled file parameter, uses realpath only to normalize it, and passes the resulting unrestricted path to the fax client. The Fax/SMS module must be enabled, and the account must have an authenticated session and an attacker-controlled fax number; exposure is limited to files readable by the web-server process.