{"id":"CVE-2026-126429","kind":"vulnerability","aliases":["CVE-2026-126429"],"related":[],"title":"OpenEMR: authenticated users can read server files through PDF generation","description":"OpenEMR before 8.5.0 passes authenticated user-controlled HTML from the doc_lib.php content parameter to mPDF, which resolves local files and nested SVG resources. Authenticated patients or core users can submit crafted CSS imports or php://filter SVG references to read arbitrary server files including credentials and OAuth keys.","summary":"OpenEMR passes user-supplied HTML from the doc_lib.php content parameter to the mPDF library, which resolves local files and nested SVG resources. An authenticated patient or core user can craft CSS imports or php://filter SVG references to read arbitrary server files, including credentials and OAuth keys.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","php","runtime","self-hosted"],"not_affected_if":["openemr-8.5.0-or-later"],"how_to_check":"- Check the OpenEMR version in the installed application; versions before `8.5.0` are listed as affected.","fix":"- OpenEMR: move to `8.5.0` or later.","status":"open","published_at":"2026-11-13T10:17:49+00:00","first_seen_at":"2026-11-13T10:47:21+00:00","triaged_at":"2026-11-13T10:53:11+00:00","updated_at":"2026-11-13T10:53:11+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-13T10:53:11Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: move to `8.5.0` or later.","reach":"internet","title":"OpenEMR: authenticated users can read server files through PDF generation","impact":"high","summary":"OpenEMR passes user-supplied HTML from the doc_lib.php content parameter to the mPDF library, which resolves local files and nested SVG resources. An authenticated patient or core user can craft CSS imports or php://filter SVG references to read arbitrary server files, including credentials and OAuth keys.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["openemr","healthcare","self-hosted","php"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Arbitrary server files readable, including credentials and OAuth keys","analyst_note":"Confirm the exact affected version range and whether patient portal access is enough to trigger it, using the vendor advisory on github.com.   ','product_name':'','product_ecosystem':''}  nope fix.Thanks","how_to_check":"- Check the OpenEMR version in the installed application; versions before `8.5.0` are listed as affected.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["openemr-8.5.0-or-later"],"who_is_affected":"OpenEMR installations before 8.5.0 where authenticated patients or core users can reach the document library upload path that renders content through mPDF. Patient portal users count as authenticated users, so the portal is in scope. The sources do not say whether non-default configuration is required.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000749,"input_tokens":4616,"output_tokens":574,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126429':13A,16A '-2026':12A,15A '8.5.0':73C 'arbitrari':63B,111C 'authent':2A,48B,75C,95C 'content':33B,83C 'control':78C 'core':51B,98C 'craft':54B,102C 'credenti':67B,115C 'css':55B,103C 'cve':11A,14A 'doc_lib.php':32B,82C 'file':7A,42B,65B,90C,113C 'filter':58B,106C 'generat':10A 'healthcar':17B 'host':23B 'html':29B,79C 'import':56B,104C 'includ':66B,114C 'key':70B,118C 'librari':38B 'local':41B,89C 'mpdf':37B,86C 'nest':44B,92C 'oauth':69B,117C 'openemr':1A,18B,24B,71C 'paramet':34B,84C 'pass':25B,74C 'patient':49B,96C 'pdf':9A 'php':19B 'read':5A,62B,110C 'refer':60B,108C 'resolv':40B,88C 'resourc':46B,94C 'runtim':20B 'self':22B 'self-host':21B 'server':6A,64B,112C 'submit':101C 'suppli':28B 'svg':45B,59B,93C,107C 'user':3A,27B,52B,77C,99C 'user-control':76C 'user-suppli':26B","nicknames":[],"mitigations":[],"who_affected":"OpenEMR installations before 8.5.0 where authenticated patients or core users can reach the document library upload path that renders content through mPDF. Patient portal users count as authenticated users, so the portal is in scope. The sources do not say whether non-default configuration is required.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","high","openemr","php","runtime","selfhosted"],"campaign_type":null,"search_a":"'-126429':13A,16A '-2026':12A,15A 'authent':2A 'cve':11A,14A 'file':7A 'generat':10A 'openemr':1A 'pdf':9A 'read':5A 'server':6A 'user':3A","search_b":"'arbitrari':63B 'authent':48B 'content':33B 'core':51B 'craft':54B 'credenti':67B 'css':55B 'doc_lib.php':32B 'file':42B,65B 'filter':58B 'healthcar':17B 'host':23B 'html':29B 'import':56B 'includ':66B 'key':70B 'librari':38B 'local':41B 'mpdf':37B 'nest':44B 'oauth':69B 'openemr':18B,24B 'paramet':34B 'pass':25B 'patient':49B 'php':19B 'read':62B 'refer':60B 'resolv':40B 'resourc':46B 'runtim':20B 'self':22B 'self-host':21B 'server':64B 'suppli':28B 'svg':45B,59B 'user':27B,52B 'user-suppli':26B","search_c":"'8.5.0':73C 'arbitrari':111C 'authent':75C,95C 'content':83C 'control':78C 'core':98C 'craft':102C 'credenti':115C 'css':103C 'doc_lib.php':82C 'file':90C,113C 'filter':106C 'html':79C 'import':104C 'includ':114C 'key':118C 'local':89C 'mpdf':86C 'nest':92C 'oauth':117C 'openemr':71C 'paramet':84C 'pass':74C 'patient':96C 'read':110C 'refer':108C 'resolv':88C 'resourc':94C 'server':112C 'submit':101C 'svg':93C,107C 'user':77C,99C 'user-control':76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T01:35:10+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126429","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126429","severity":null,"published_at":"2026-11-13T10:17:49+00:00","modified_at":"2026-11-13T10:17:49+00:00","first_seen_at":"2026-11-13T10:47:21+00:00","fetched_at":"2026-11-13T10:47:21+00:00","note":null}],"documents":[{"id":145102,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-h4xc-pqg3-8459","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-28T01:35:10+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145103,"url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-local-file-disclosure-via-doc-lib-php-pdf-renderer","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}