OpenEMR up to 8.2.x Patient Session Template Download library/ajax/set_pt.php cross-site request forgery

Summaryinfo

A vulnerability described as problematic has been identified in OpenEMR up to 8.2.x. This impacts an unknown function of the file library/ajax/set_pt.php of the component Patient Session Template Download. Such manipulation leads to cross-site request forgery. This vulnerability is referenced as CVE-2026-104139. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in OpenEMR up to 8.2.x. Affected by this issue is an unknown code block of the file library/ajax/set_pt.php of the component Patient Session Template Download. The manipulation with an unknown input leads to a cross-site request forgery vulnerability. Using CWE to declare the problem leads to CWE-352. The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. Impacted is integrity. CVE summarizes:

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/ajax/set_pt.php allows any authenticated user to set an arbitrary patient identifier in the active session without an ACL check, and interface/patient_file/download_template.php trusts that session value while enforcing only CSRF validation. A low-privilege user can select another patient and download a rendered document template containing the patient's demographics, encounter information, allergies, medications, and problem list despite lacking patients/docs access. This issue is fixed in version 8.3.0.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-104139 since 10/01/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available.

By approaching the search of inurl:library/ajax/set_pt.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 8.3.0 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Business Process Management Software

Name

• OpenEMR

Version

• 8.0
• 8.1
• 8.2

License

• open-source

Website

• Product: https://github.com/openemr/openemr/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion