Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-67612 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

OpenEMR through 8.2.0 contains a stored cross-site scripting vulnerability in the patient portal template system that allows authenticated administrators to inject arbitrary HTML and JavaScript by storing malicious payloads through the template save mode, which only filters literal PHP open tags. Attackers can exploit the lack of output encoding at the template retrieval endpoint combined with missing HttpOnly cookie attributes to exfiltrate session tokens via document.cookie access, enabling full session hijacking of any admin, clinician, or portal patient who views a poisoned template.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:5.4 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CNA: [email protected]CVSS-B:4.8 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://jivasecurity.com/writeups/openemr-portal-template-stored-xss	[email protected]	ExploitTechnical Analysis
https://www.vulncheck.com/advisories/openemr-stored-xss-via-import-template-php-template-management	[email protected]	Advisory

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-79	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	[email protected]

Affected Products

Product	Versions
OpenEMR	<= 8.2.0 (semver)
CPE cpe:2.3:a:open-emr:openemr:::::::: Remediation Mitigation:low effort Set the HttpOnly flag on the OpenEMR session cookie to prevent JavaScript from accessing it. Mitigation:low effort Configure the template retrieval endpoint to return a Content-Type of text/plain or text/html with output encoded using htmlspecialchars(). Alternatively, configure it to return a Content-Disposition header with a value of attachment to force browsers to download the template instead of rendering it. Mitigation:low effort Implement an allowlist-based HTML sanitizer to filter out unsafe content when saving templates. Mitigation:low effort Add ownership verification to the template retrieval endpoint to prevent unauthorized users from accessing templates they do not own.

Product

Versions

OpenEMR

<= 8.2.0 (semver)

CPE

cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*

Remediation

Mitigation:low effort
Set the HttpOnly flag on the OpenEMR session cookie to prevent JavaScript from accessing it.
Mitigation:low effort
Configure the template retrieval endpoint to return a Content-Type of text/plain or text/html with output encoded using htmlspecialchars(). Alternatively, configure it to return a Content-Disposition header with a value of attachment to force browsers to download the template instead of rendering it.
Mitigation:low effort
Implement an allowlist-based HTML sanitizer to filter out unsafe content when saving templates.
Mitigation:low effort
Add ownership verification to the template retrieval endpoint to prevent unauthorized users from accessing templates they do not own.

Change History

2 change records found show changes

Date	Action	Recorded By
Aug 3, 2026	New CVE Received	[email protected]
Aug 3, 2026	CVE Modified	CISA-ADP