CVE-2026-126429: OpenEMR before 8.5.0 Local File Disclosure via doc_lib.php PDF Renderer
OpenEMR before 8.5.0 passes authenticated user-controlled HTML from the doclib.php content parameter to mPDF, which resolves local files and nested SVG resources. Authenticated patients or core users can submit crafted CSS imports or php://filter SVG references to read arbitrary server files including credentials and OAuth keys.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenEMRto a version that resolves this vulnerability.Fixed in 8.5.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated patient or core user can exploit it. No user interaction is required.
What access does an attacker need to disclose files?
The attacker needs an account that can submit attacker-controlled HTML through the doc_lib.php content parameter. Crafted CSS imports or SVG references using php://filter can then cause the PDF renderer to read local server files.
Are installations on version 8.5.0 affected?
The issue affects OpenEMR versions before 8.5.0. The provided information does not identify any other affected version ranges or configuration prerequisites.
What data could be exposed?
An attacker may read arbitrary files accessible to the OpenEMR process, including credentials and OAuth keys. The vulnerability is a confidentiality issue; no integrity or availability impact is specified.