CVE-2026-67612
Received Received - Intake

Stored XSS in OpenEMR Patient Portal Template System

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: VulnCheck

Description
OpenEMR through 8.2.0 contains a stored cross-site scripting vulnerability in the patient portal template system that allows authenticated administrators to inject arbitrary HTML and JavaScript by storing malicious payloads through the template save mode, which only filters literal PHP open tags. Attackers can exploit the lack of output encoding at the template retrieval endpoint combined with missing HttpOnly cookie attributes to exfiltrate session tokens via document.cookie access, enabling full session hijacking of any admin, clinician, or portal patient who views a poisoned template.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-03
AI Q&A
2026-08-03
EPSS Evaluated
N/A
NVD
CVE-2026-67612
EUVD
EUVD-2026-52349

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openemr openemr to 8.2.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenEMR through 8.2.0 has a stored cross-site scripting (XSS) vulnerability in its patient portal template system. Authenticated administrators can inject malicious HTML and JavaScript by saving a poisoned template. The system fails to filter PHP open tags properly, and templates are not encoded when retrieved, allowing attackers to steal session tokens via document.cookie and hijack sessions of admins, clinicians, or patients.

Detection Guidance

Check OpenEMR logs for suspicious template modifications or unauthorized HTML/JS injections. Inspect network traffic for unusual cookie exfiltration attempts or template retrieval requests from untrusted sources.

Impact Analysis

If you are an admin, clinician, or patient using OpenEMR, an attacker could hijack your session by tricking you into viewing a malicious template. This could lead to unauthorized access to sensitive data, account takeover, or further exploitation of the system under your credentials.

Compliance Impact

This vulnerability could violate GDPR by exposing personal data through session hijacking and HIPAA by compromising protected health information. It undermines data confidentiality and integrity requirements, potentially leading to regulatory penalties and loss of trust.

Mitigation Strategies

Update OpenEMR to the latest version beyond 8.2.0. Apply strict input validation for template content and enable HttpOnly cookie attributes. Review and sanitize existing templates for malicious payloads.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-67612. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart