{"id":"CVE-2026-126464","kind":"vulnerability","aliases":["CVE-2026-126464"],"related":[],"title":"OpenEMR: patient portal PDF generator lets patients probe internal servers","description":"OpenEMR before 8.5.0 contains a server-side request forgery vulnerability in PatientPortalPDFDocumentCreator::createPdfObject() that allows authenticated patients to make the server issue HTTP GET requests. Attackers can submit img src, inline style url(), or reinserted unpurified style blocks via the content parameter of portal/lib/doc_lib.php to probe internal ports and cloud metadata endpoints.","summary":"OpenEMR versions before 8.5.0 let an authenticated patient make the server send HTTP GET requests through the PDF document generator. An attacker can use this to probe internal ports and cloud metadata endpoints.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","other","patient-portal","self-hosted"],"not_affected_if":["managed-hosting","patient-portal-disabled"],"how_to_check":"- Check the OpenEMR version in the installed application; versions below `8.5.0` are in scope.\n- Confirm whether the patient portal is enabled and whether patients can log in to it.","fix":"- OpenEMR: upgrade to `8.5.0` or later.","status":"open","published_at":"2026-11-13T10:17:55+00:00","first_seen_at":"2026-11-13T10:47:24+00:00","triaged_at":"2026-11-13T10:57:09+00:00","updated_at":"2026-11-13T10:57:09+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-13T10:57:09Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: upgrade to `8.5.0` or later.","reach":"internet","title":"OpenEMR: patient portal PDF generator lets patients probe internal servers","impact":"medium","summary":"OpenEMR versions before 8.5.0 let an authenticated patient make the server send HTTP GET requests through the PDF document generator. An attacker can use this to probe internal ports and cloud metadata endpoints.","audience":"businesses","category":"other","nicknames":[],"who_cares":["openemr","healthcare","self-hosted","patient-portal"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Server reaches internal services and cloud metadata endpoints","analyst_note":"","how_to_check":"- Check the OpenEMR version in the installed application; versions below `8.5.0` are in scope.\n- Confirm whether the patient portal is enabled and whether patients can log in to it.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["patient-portal-disabled","managed-hosting"],"who_is_affected":"Clinics and hospitals that run OpenEMR with the patient portal enabled are exposed, because any logged-in patient can trigger server-side requests. Installs without the patient portal, or with patient accounts disabled, are less exposed. Cloud-hosted installs may expose metadata endpoints, which raises the impact.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000725,"input_tokens":4632,"output_tokens":523,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126464':13A,16A '-2026':12A,15A '8.5.0':29B,61C 'allow':74C 'attack':47B,85C 'authent':32B,75C 'block':97C 'cloud':56B,109C 'contain':62C 'content':100C 'createpdfobject':72C 'cve':11A,14A 'document':44B 'endpoint':58B,111C 'forgeri':68C 'generat':5A,45B 'get':39B,83C 'healthcar':17B 'host':25B 'http':38B,82C 'img':88C 'inlin':90C 'intern':9A,53B,106C 'issu':81C 'let':6A,30B 'make':34B,78C 'metadata':57B,110C 'openemr':1A,18B,26B,59C 'paramet':101C 'patient':2A,7A,21B,33B,76C 'patient-port':20B 'patientportalpdfdocumentcr':71C 'pdf':4A,43B 'port':54B,107C 'portal':3A,22B 'portal/lib/doc_lib.php':103C 'probe':8A,52B,105C 'reinsert':94C 'request':40B,67C,84C 'self':24B 'self-host':23B 'send':37B 'server':10A,36B,65C,80C 'server-sid':64C 'side':66C 'src':89C 'style':91C,96C 'submit':87C 'unpurifi':95C 'url':92C 'use':49B 'version':27B 'via':98C 'vulner':69C","nicknames":[],"mitigations":[],"who_affected":"Clinics and hospitals that run OpenEMR with the patient portal enabled are exposed, because any logged-in patient can trigger server-side requests. Installs without the patient portal, or with patient accounts disabled, are less exposed. Cloud-hosted installs may expose metadata endpoints, which raises the impact.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","medium","openemr","other","patientportal","selfhosted"],"campaign_type":null,"search_a":"'-126464':13A,16A '-2026':12A,15A 'cve':11A,14A 'generat':5A 'intern':9A 'let':6A 'openemr':1A 'patient':2A,7A 'pdf':4A 'portal':3A 'probe':8A 'server':10A","search_b":"'8.5.0':29B 'attack':47B 'authent':32B 'cloud':56B 'document':44B 'endpoint':58B 'generat':45B 'get':39B 'healthcar':17B 'host':25B 'http':38B 'intern':53B 'let':30B 'make':34B 'metadata':57B 'openemr':18B,26B 'patient':21B,33B 'patient-port':20B 'pdf':43B 'port':54B 'portal':22B 'probe':52B 'request':40B 'self':24B 'self-host':23B 'send':37B 'server':36B 'use':49B 'version':27B","search_c":"'8.5.0':61C 'allow':74C 'attack':85C 'authent':75C 'block':97C 'cloud':109C 'contain':62C 'content':100C 'createpdfobject':72C 'endpoint':111C 'forgeri':68C 'get':83C 'http':82C 'img':88C 'inlin':90C 'intern':106C 'issu':81C 'make':78C 'metadata':110C 'openemr':59C 'paramet':101C 'patient':76C 'patientportalpdfdocumentcr':71C 'port':107C 'portal/lib/doc_lib.php':103C 'probe':105C 'reinsert':94C 'request':67C,84C 'server':65C,80C 'server-sid':64C 'side':66C 'src':89C 'style':91C,96C 'submit':87C 'unpurifi':95C 'url':92C 'via':98C 'vulner':69C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T01:35:28+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126464","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126464","severity":null,"published_at":"2026-11-13T10:17:55+00:00","modified_at":"2026-11-13T10:17:55+00:00","first_seen_at":"2026-11-13T10:47:24+00:00","fetched_at":"2026-11-13T10:47:24+00:00","note":null}],"documents":[{"id":145171,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-wc8m-q5xj-j34x","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-28T01:35:28+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145172,"url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-ssrf-via-patient-portal-pdf-generation","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}