The vulnerability arises when the PDF generation function in OpenEMR parses form answers as unescaped HTML. An attacker who can submit an Eye Exam form in the Notes - my encounters role can embed image references to arbitrary files located on the server. During PDF creation those images are retrieved and embedded, effectively exposing the file contents. This results in an arbitrary file read that can expose patient records, configuration files, or other sensitive data. The weakness maps to the text‑based input validation category (CWE-116).

All OpenEMR installations from the OpenEMR product line running versions earlier than 8.0.0.2. The affected functionality is the PDF printing of Eye Exam forms submitted through the Notes - my encounters role. Version 8.0.0.2 and later contain a fix that removes unescaped HTML parsing from the PDF generation routine.

The CVSS score of 7.1 indicates a moderate to high risk. The EPSS probability is below 1 %, and the vulnerability is not listed in the CISA KEV catalog, suggesting low likelihood of widespread exploitation. The primary attack vector is through the web application's form submission, requiring an authenticated user with the Notes - my encounters role. Once the PDF is generated, the attacker gains read access to arbitrary server files, compromising confidentiality of sensitive data. The overall risk under typical conditions is moderate, but because the impact includes exposure of potentially confidential medical records, prompt remediation is advised.