CVE-2026-67612 in OpenEMR
Summary
by MITRE • 08/03/2026
OpenEMR through 8.2.0 contains a stored cross-site scripting vulnerability in the patient portal template system that allows authenticated administrators to inject arbitrary HTML and JavaScript by storing malicious payloads through the template save mode, which only filters literal PHP open tags. Attackers can exploit the lack of output encoding at the template retrieval endpoint combined with missing HttpOnly cookie attributes to exfiltrate session tokens via document.cookie access, enabling full session hijacking of any admin, clinician, or portal patient who views a poisoned template.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/03/2026
The vulnerability exists within the OpenEMR patient portal template system where authenticated administrators can inject malicious code through the template save functionality. This stored cross-site scripting flaw affects versions up to 8.2.0 and stems from insufficient input validation during template storage operations. The system only filters literal PHP open tags while failing to adequately sanitize other potentially dangerous constructs that could be executed within the web context. This filtering mechanism represents a classic security bypass where attackers can circumvent basic protections by using alternative payload formats that evade simple pattern matching.
The technical exploitation occurs when malicious payloads are stored in templates and subsequently retrieved without proper output encoding at the template rendering endpoint. This lack of proper sanitization creates an environment where attacker-controlled content can be executed within the browser context of legitimate users who view affected templates. The vulnerability is particularly dangerous because it operates through a trusted administrative interface, allowing attackers with administrator privileges to establish persistent malicious presence within the system. The absence of output encoding at retrieval points directly violates secure coding principles and creates direct attack vectors for client-side exploitation.
The operational impact extends beyond simple script execution as attackers can leverage this vulnerability to harvest session tokens through document.cookie access mechanisms. Without proper HttpOnly cookie attributes set on session cookies, attackers can access sensitive authentication data that would otherwise be protected from JavaScript access. This combination of stored XSS with missing security headers creates a complete session hijacking scenario where any user who views the compromised template can have their session tokens stolen. The vulnerability affects all user roles including administrators, clinicians, and portal patients, making it particularly dangerous for healthcare organizations that rely on patient portal systems.
Mitigation strategies should focus on implementing comprehensive input validation and output encoding throughout the template system. The solution requires proper sanitization of all user-provided content during storage operations and strict output encoding at retrieval points to prevent execution of malicious code. Security headers including HttpOnly flags must be implemented for all session cookies to prevent JavaScript-based cookie theft. Additionally, privilege separation should be enforced where possible to limit the impact of compromised administrator accounts. This vulnerability aligns with CWE-79 (Cross-site Scripting) and represents a typical attack pattern categorized under ATT&CK technique T1566 (Phishing) and T1071.004 (Application Layer Protocol: DNS). Organizations should implement regular security assessments, input validation controls, and ensure proper cookie security attributes are configured to prevent similar vulnerabilities in healthcare information systems that handle sensitive patient data.