CVE-2026-126464

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-126464
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126464.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-126464
Aliases
  • GHSA-wc8m-q5xj-j34x
Published
2026-11-13T09:35:04Z
Modified
2026-11-14T02:47:03Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L CVSS Calculator
Summary
OpenEMR before 8.5.0 SSRF via Patient Portal PDF Generation
Details

OpenEMR before 8.5.0 contains a server-side request forgery vulnerability in PatientPortalPDFDocumentCreator::createPdfObject() that allows authenticated patients to make the server issue HTTP GET requests. Attackers can submit img src, inline style url(), or reinserted unpurified style blocks via the content parameter of portal/lib/doc_lib.php to probe internal ports and cloud metadata endpoints.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126464.json"
}
References

Affected packages

Git / github.com/openemr/openemr

Affected ranges

Type
GIT
Repo
https://github.com/openemr/openemr
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
c1b2b8bcbe91aa81858f7ba8b25c31d9a82639a5
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "8.5.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        }
    ]
}

Affected versions

Other
v2_7_2
v2_7_2-rc1
v2_7_2-rc2
v2_7_3-rc1
v2_8_0
v2_8_1
v2_8_2
v2_8_3
v2_9_0
v3_0_0
v3_0_1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126464.json"