A server‑side request forgery was discovered in the PDF generation routine that processes eye exam form answers. The answers are parsed as unescaped HTML, allowing an attacker to embed URLs that the server then requests out‑of‑band. This flaw enables the server to contact arbitrary external or internal endpoints, potentially exposing sensitive data, enumerating internal services, or chaining to other vulnerabilities. The weakness corresponds to CWE‑918 and carries a CVSS score of 7.2.

The flaw exists in OpenEMR releases prior to 8.0.0.2. Users who have the "Notes ­– my encounters" role, which allows them to fill and print eye exam forms as PDFs, are susceptible. Any deployment of OpenEMR before the 8.0.0.2 update that provides this functionality is affected.

The CVSS score indicates a high risk, and with an EPSS below 1 % the likelihood of a widespread exploitation today is low, yet the possibility of targeted attacks remains. Because the attack requires the ability to submit form data, an attacker would need either access to the application user interface or a privilege escalation within the application. The flaw is not currently listed in CISA's KEV catalog, but the expansion of network‑based attacks via SSRF makes it a high‑severity concern that should be addressed promptly.