CVE-2026-126464

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.5.0

Description Authenticated patients can trigger server-side request forgery, a flaw where the server is coerced into making unauthorized requests. By submitting img src, inline style url(), or unpurified style blocks through the content parameter of the 'portal/lib/doc lib.php' endpoint, an attacker can force the server to issue HTTP GET requests. This can be used to probe internal ports and cloud metadata endpoints via the createPdfObject() function.

Recommendations Update to version 8.5.0 or later. Restrict the use of the content parameter in the 'portal/lib/doc lib.php' endpoint as a temporary mitigation.