CVE-2026-33303: 
OpenEMR vulnerability analysis and mitigation

CVE-2026-33303 is a stored cross-site scripting (XSS) vulnerability in OpenEMR, a widely used open-source electronic health records and medical practice management application. The flaw exists in versions prior to 8.0.0.2 and allows an authenticated patient portal user to inject a malicious JavaScript payload via their login username, which then executes in the browser of any clinic staff member who opens the "Create Portal Login" page for that patient. This effectively crosses the trust boundary from the low-privilege patient session context into the high-privilege staff/admin session context. The vulnerability was published on March 19, 2026, and carries a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a missing output-escaping filter in the Twig template templates/patient/portal_login/print.html.twig. The Twig environment is configured with autoescape=false (src/Common/Twig/TwigContainer.php, line 66), meaning all fields must be manually escaped. Line 83 of the template renders {{ login_uname }} without the |attr escaping filter, while all adjacent fields (e.g., csrfToken, uname, pwd) correctly use |attr. On the write path, a patient changes their username via portal/account/index_reset.php; the value is stored in the patient_access_onsite table with no character validation — only non-empty and password-correctness checks are performed. On the read path, interface/patient_file/summary/create_portallogin.php passes the raw database value directly to the template, allowing a payload such as "><img src=x onerror=alert(document.domain)> to break out of the HTML value attribute and execute arbitrary JavaScript (GitHub Advisory, Patch Commit).

Successful exploitation allows a low-privilege patient portal user to execute arbitrary JavaScript in the browser session of a clinic staff member or administrator, crossing a significant trust boundary. The injected script can steal staff session cookies, read sensitive patient health information displayed on the page, and perform unauthorized actions within the staff member's session — such as submitting forms, modifying records, or escalating privileges. While availability is not directly impacted, the confidentiality and integrity risks are meaningful given that OpenEMR handles protected health information (PHI) for an estimated 100,000+ healthcare providers (GitHub Advisory, Aisle Blog).

A proof-of-concept exploit is publicly documented in the GitHub Security Advisory, providing a detailed 6-step reproduction sequence with specific endpoints, parameter names, and example payloads (GitHub Advisory). Exploitation requires a valid patient portal account (low privilege) and staff interaction with the targeted patient's portal credential page (user interaction required). There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.029% (0.000290), reflecting a low probability of near-term exploitation (Feedly).

1. Obtain a patient portal account: Register or log in to the OpenEMR patient portal as any valid patient user.
2. Navigate to the credential change page: Go to portal/account/index_reset.php (the portal credential change/reset page).
3. Inject the XSS payload as the username: In the "Change Username" field, enter a payload such as "><img src=x onerror=alert(document.domain)>. If client-side validation blocks special characters, bypass the pattern attribute using browser developer tools or by sending a direct HTTP POST request.
4. Submit the form: Provide the correct current password and submit the form. The payload is stored in the patient_access_onsite table without any server-side character validation.
5. Wait for staff interaction: The payload remains dormant until a clinic staff member opens the targeted patient's chart and clicks "Create Portal Login" (interface/patient_file/summary/create_portallogin.php).
6. Payload executes in staff browser: The unescaped login_uname value is rendered on line 83 of templates/patient/portal_login/print.html.twig, breaking out of the HTML value attribute and executing the injected JavaScript in the staff member's browser session, enabling session token theft, page content manipulation, or unauthorized form submissions (GitHub Advisory).

• Network: Unusual HTTP POST requests to portal/account/index_reset.php containing script-like characters (e.g., <, >, ", onerror, alert, document.cookie) in the username parameter; unexpected outbound connections from the OpenEMR server following staff access to portal credential pages.
• Logs: OpenEMR access logs showing POST requests to portal/account/index_reset.php with encoded or raw XSS payloads in the username field; staff access logs showing requests to interface/patient_file/summary/create_portallogin.php for patients with suspicious usernames.
• Database: Entries in the patient_access_onsite table where portal_login_username contains HTML special characters such as <, >, ", or JavaScript keywords (onerror, script, alert, document).
• Browser/Session: Unexpected session token exfiltration or anomalous authenticated requests performed under a staff user's session shortly after that staff member viewed a patient's portal credential page (GitHub Advisory).

The fix is available in OpenEMR version 8.0.0.2, which adds the |attr escaping filter to the login_uname variable in templates/patient/portal_login/print.html.twig (line 83), matching the escaping already applied to all adjacent fields (Patch Commit). All installations running versions 8.0.0.1 and earlier should upgrade to 8.0.0.2 or later immediately. As a temporary workaround until patching is possible, restrict staff access to the "Create Portal Login" functionality and monitor the patient_access_onsite table for patient usernames containing script-like characters (GitHub Advisory).

The vulnerability was reported by researchers pavelkohout396, simecek, stanislavfortaisle, and lassiiiiii, and was remediated by OpenEMR maintainer kojiromike (GitHub Advisory). Aisle published a blog post highlighting this CVE as part of a broader disclosure of 38 security vulnerabilities found in OpenEMR, noting the software is used by over 100,000 healthcare providers — drawing attention to systemic security concerns in widely deployed healthcare software (Aisle Blog). Community discussion was limited, with the vulnerability tracked on standard CVE aggregation platforms shortly after disclosure.