What is GHSA-gvxx-27r9-p46h?

GHSA-gvxx-27r9-p46h is a security advisory published by GitHub Security Advisories with Medium severity. OpenEMR before 8.5.0 contains a server-side request forgery vulnerability in...

Which CVE IDs does GHSA-gvxx-27r9-p46h cover?

GHSA-gvxx-27r9-p46h covers the following CVE IDs: CVE-2026-126464. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-gvxx-27r9-p46h?

GHSA-gvxx-27r9-p46h has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

GHSA-gvxx-27r9-p46hMediumCVSS 4.3

OpenEMR before 8.5.0 contains a server-side request forgery vulnerability in...

Vendor

GitHub Security Advisories

Published

November 13, 2026

Last Modified

November 13, 2026

🔗 CVE IDs covered (1)

CVE-2026-126464 →

📋 Description

OpenEMR before 8.5.0 contains a server-side request forgery vulnerability in PatientPortalPDFDocumentCreator::createPdfObject() that allows authenticated patients to make the server issue HTTP GET requests. Attackers can submit img src, inline style url(), or reinserted unpurified style blocks via the content parameter of portal/lib/doc_lib.php to probe internal ports and cloud metadata endpoints.

🔗 References (4)

https://github.com/openemr/openemr/security/advisories/GHSA-wc8m-q5xj-j34x
https://nvd.nist.gov/vuln/detail/CVE-2026-126464
https://www.vulncheck.com/advisories/openemr-before-8.5.0-ssrf-via-patient-portal-pdf-generation
https://github.com/advisories/GHSA-gvxx-27r9-p46h