CVE-2026-126464: OpenEMR before 8.5.0 SSRF via Patient Portal PDF Generation
OpenEMR before 8.5.0 contains a server-side request forgery vulnerability in PatientPortalPDFDocumentCreator::createPdfObject() that allows authenticated patients to make the server issue HTTP GET requests. Attackers can submit img src, inline style url(), or reinserted unpurified style blocks via the content parameter of portal/lib/doclib.php to probe internal ports and cloud metadata endpoints.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated patient account. The vulnerable PDF-generation path is in the patient portal and is reached through the content parameter of portal/lib/doc_lib.php.
What requests can an attacker cause the server to make?
The attacker can cause HTTP GET requests by supplying image sources, inline CSS url() values, or reinserted unpurified style blocks. The reported targets include internal ports and cloud metadata endpoints.
Are default deployments affected?
The provided information does not state whether the affected patient portal PDF-generation functionality is enabled or reachable in a default deployment.
What versions are affected?
OpenEMR versions before 8.5.0 are affected. Updating to 8.5.0 or later addresses the stated affected version range.