CVE-2026-126464

OpenEMR before 8.5.0 contains a server-side request forgery vulnerability in PatientPortalPDFDocumentCreator::createPdfObject that allows authenticated patients to make the server issue HTTP GET requests. Attackers can submit img src, inline style url, or reinserted unpurified style blocks via th...

CVE-2026-126429

OpenEMR before 8.5.0 passes authenticated user-controlled HTML from the doclib.php content parameter to mPDF, which resolves local files and nested SVG resources. Authenticated patients or core users can submit crafted CSS imports or php://filter SVG references to read arbitrary server files...

CVE-2026-126429

OpenEMR versions prior to 8.5.0 are vulnerable to Local File Disclosure via the doc_lib.php PDF renderer. The application passes authenticated user-controlled HTML from the content parameter to mPDF , which fails to properly restrict the resolution of local files and nested SVG resources. Authent...

EUVD-2026-125014

OpenEMR before 8.5.0 passes authenticated user-controlled HTML from the doclib.php content parameter to mPDF, which resolves local files and nested SVG resources. Authenticated patients or core users can submit crafted CSS imports or php://filter SVG references to read arbitrary server files...

CVE-2026-126464

The OpenEMR software (versions before 8.5.0 ) contains a Server-Side Request Forgery (SSRF) vulnerability within the PatientPortalPDFDocumentCreator::createPdfObject() function. Authenticated patients can trigger the server to issue HTTP GET requests by submitting malicious img src, inline style ...

EUVD-2026-124960

OpenEMR before 8.5.0 contains a server-side request forgery vulnerability in PatientPortalPDFDocumentCreator::createPdfObject that allows authenticated patients to make the server issue HTTP GET requests. Attackers can submit img src, inline style url, or reinserted unpurified style blocks via th...

CVE-2026-126464 OpenEMR before 8.5.0 SSRF via Patient Portal PDF Generation

OpenEMR before 8.5.0 contains a server-side request forgery vulnerability in PatientPortalPDFDocumentCreator::createPdfObject that allows authenticated patients to make the server issue HTTP GET requests. Attackers can submit img src, inline style url, or reinserted unpurified style blocks via th...