---
id: "CVE-2026-126464"
page: "https://infrastack.ai/live/CVE-2026-126464"
kind: "vulnerability"
aliases: ["CVE-2026-126464"]
title: "OpenEMR: patient portal PDF generator lets patients probe internal servers"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["healthcare", "openemr", "other", "patient-portal", "self-hosted"]
not_affected_if: ["managed-hosting", "patient-portal-disabled"]
published_at: "2026-11-13T10:17:55+00:00"
first_seen_at: "2026-11-13T10:47:24+00:00"
updated_at: "2026-11-13T10:57:09+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126464", "first_seen_at": "2026-11-13T10:47:24+00:00"}]
exploit_sources: []
---

# OpenEMR: patient portal PDF generator lets patients probe internal servers

Link for people: https://infrastack.ai/live/CVE-2026-126464 (this .md is for agents)

OpenEMR versions before 8.5.0 let an authenticated patient make the server send HTTP GET requests through the PDF document generator. An attacker can use this to probe internal ports and cloud metadata endpoints.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the OpenEMR version in the installed application; versions below `8.5.0` are in scope.
- Confirm whether the patient portal is enabled and whether patients can log in to it.

## Fix

- OpenEMR: upgrade to `8.5.0` or later.

## Timeline

- 2026-11-13T10:47:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126464

## Documents

- [advisory] Vendor advisory: github.com https://github.com/openemr/openemr/security/advisories/GHSA-wc8m-q5xj-j34x
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/openemr-before-8.5.0-ssrf-via-patient-portal-pdf-generation

## From the sources

OpenEMR before 8.5.0 contains a server-side request forgery vulnerability in PatientPortalPDFDocumentCreator::createPdfObject() that allows authenticated patients to make the server issue HTTP GET requests. Attackers can submit img src, inline style url(), or reinserted unpurified style blocks via the content parameter of portal/lib/doc_lib.php to probe internal ports and cloud metadata endpoints.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_