CVE-2026-126464

CVSS 5.3 (medium) · published 2026-11-13

OpenEMR before 8.5.0 contains a server-side request forgery vulnerability in PatientPortalPDFDocumentCreator::createPdfObject() that allows authenticated patients to make the server issue HTTP GET requests. Attackers can submit img src, inline style url(), or reinserted unpurified style blocks via the content parameter of portal/lib/doc_lib.php to probe internal ports and cloud metadata endpoints.

Weakness: CWE-918

Source: NVD CVE-2026-126464

References

• https://github.com/openemr/openemr/security/advisories/GHSA-wc8m-q5xj-j34x
• https://www.vulncheck.com/advisories/openemr-before-8.5.0-ssrf-via-patient-portal-pdf-generation

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.