External Control of File Name or Path in OpenEMR - #VU158848
Published: November 3, 2026
Vulnerability identifier: #VU158848
CSH Severity: Medium
CVSS v4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-73
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose local file contents through generated PDF documents.
The vulnerability exists due to insufficient restriction of externally controlled file paths in mPDF's nested SVG resource loading when rendering user-supplied HTML submitted to POST /portal/lib/doc_lib.php. A remote user can reference an external SVG containing a nested image path beginning with :/php://filter/ to bypass the initial stream-wrapper check and embed transformed local file bytes in the returned PDF to disclose sensitive information.
Affected software
OpenEMR
Remediation
Install security update from vendor's website.
OpenEMR - update to 8.5.0