Description
OpenEMR before 8.5.0 passes authenticated user-controlled HTML from the doc_lib.php content parameter to mPDF, which resolves local files and nested SVG resources. Authenticated patients or core users can submit crafted CSS imports or php://filter SVG references to read arbitrary server files including credentials and OAuth keys.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Open-Emr | OpenEMR | 0 <8.5.0 | — |