CVE-2026-126429OpenEMR before 8.5.0 Local File Disclosure via doc_lib.php PDF Renderer

Descripción

OpenEMR before 8.5.0 passes authenticated user-controlled HTML from the doc_lib.php content parameter to mPDF, which resolves local files and nested SVG resources. Authenticated patients or core users can submit crafted CSS imports or php://filter SVG references to read arbitrary server files including credentials and OAuth keys.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• GitHub Security Advisory (GHSA-h4xc-pqg3-8459) vendor-advisory
• VulnCheck Advisory: OpenEMR before 8.5.0 Local File Disclosure via doc_lib.php PDF Renderer third-party-advisory