External Control of File Name or Path in OpenEMR - #VU158847
Published: November 3, 2026
Vulnerability identifier: #VU158847
CSH Severity: Medium
CVSS v4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-73
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose local files readable by the OpenEMR PHP process, including secrets, credentials, and patient data.
The vulnerability exists due to external control of file paths and restoration of unsanitized CSS in src/Pdf/PatientPortalPDFDocumentCreator.php when rendering user-supplied HTML as a PDF. A remote user can submit crafted content to POST /portal/lib/doc_lib.php containing CSS @import rules that load local files and incorporate their contents into a request to a user-controlled callback server to disclose sensitive information.
Affected software
OpenEMR
Remediation
Install security update from vendor's website.
OpenEMR - update to 8.5.0