CVE-2026-103935 in OpenEMR
Summary
by MITRE • 11/05/2026
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/forms/transfer_summary/new.php and interface/forms/functional_cognitive_status/new.php render stored transfer_to, code, and codetext values with text(), which uses ENT_NOQUOTES, inside double-quoted HTML value attributes. An authenticated clinical user can store a value containing a double quote that escapes the attribute and injects event-handler markup when another clinician opens the form. Successful exploitation can expose session data and protected health information or permit patient-record actions in the victim's session. This issue is fixed in version 8.3.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/05/2026
OpenEMR serves as a critical infrastructure component for healthcare organizations, managing sensitive electronic health records and medical practice workflows. The vulnerability identified within versions prior to 8.3.0 resides specifically in the form handling mechanisms of the application, affecting two primary endpoints: interface/forms/transfer_summary/new.php and interface/forms/functional_cognitive_status/new.php. These components are responsible for rendering patient data forms that clinicians interact with regularly. The core technical flaw stems from improper input validation and output encoding practices when processing stored values such as transfer_to, code, and codetext fields. Instead of employing robust sanitization or context-aware escaping techniques suitable for HTML attribute contexts, the application utilizes PHP's text() function configured with ENT_NOQUOTES flags within double-quoted HTML value attributes. This configuration fails to escape special characters that hold semantic meaning in HTML parsing engines, specifically leaving double quotes unescaped.
The operational impact of this flaw is significant due to its potential for Stored Cross-Site Scripting attacks. An authenticated clinical user can exploit the lack of proper encoding by inputting a payload containing a double quote character followed by malicious event-handler markup into any of the affected fields. When another clinician subsequently opens the form, the browser parses the unescaped content as executable script rather than static text. This allows the attacker to inject arbitrary JavaScript that executes within the context of the victim's active session. Because OpenEMR handles highly sensitive protected health information and manages critical medical workflows, this execution environment provides a powerful vector for further exploitation. The injected scripts can access cookies, local storage, or other session data associated with the authenticated user, potentially leading to unauthorized disclosure of confidential patient records or internal application configurations.
Beyond simple data exfiltration, the vulnerability permits actions to be performed in the victim's session under their authority. An attacker could manipulate form submissions, alter medical records, initiate transfers, or perform any action that requires clinical authentication without the victim's knowledge or consent. This undermines both the confidentiality and integrity aspects of the CIA triad within healthcare information systems. The persistence of the malicious payload means that exploitation does not require social engineering to trick a user into clicking a link; it relies on the routine workflow of viewing patient forms, making detection difficult until significant damage has occurred.
This vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. Specifically, it represents a stored variant where malicious content is saved in the application's database and served to other users later. From an adversary perspective, this maps to ATT&CK technique T1059, Command and Scripting Interpreter, specifically JavaScript execution within a browser context. It also relates to T1530, Data from Local System, if used for data exfiltration of session tokens or sensitive files accessible via the DOM.
Mitigation strategies must prioritize immediate patching as the vendor has released version 8.3.0 which addresses these encoding flaws. Administrators should upgrade their OpenEMR instances to this patched version immediately to eliminate the root cause. For environments where upgrading is not instantly feasible, input validation controls can be implemented at the application layer to reject or sanitize double quotes and other special characters in form fields before they are stored in the database. Additionally, implementing a Content Security Policy with strict directives regarding script execution can mitigate the impact of any successfully injected scripts by preventing unauthorized JavaScript from running. Regular security audits focusing on output encoding practices across all user-facing forms are recommended to prevent similar vulnerabilities in other modules of the application.