PT-2026-146715
CVE-2026-126429
·
Published
2026-11-13
·
Updated
2026-11-13
Description by
CVSS 3.1
6.5
MediumMetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
OpenEMR before 8.5.0 passes authenticated user-controlled HTML from the doc lib.php content parameter to mPDF, which resolves local files and nested SVG resources. Authenticated patients or core users can submit crafted CSS imports or php://filter SVG references to read arbitrary server files including credentials and OAuth keys.
Found an issue in the description? Have something to add? Feel free to write us 👾