Openemr
CVE-2026-33933
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionGitHub Advisory
OpenEMR is a free and open source electronic health records and medical practice management application. Starting in version 7.0.2.1 and prior to version 8.0.0.3, a reflected cross-site scripting (XSS) vulnerability in the custom template editor allows an attacker to execute arbitrary JavaScript in an authenticated staff member's browser session by sending them a crafted URL. The attacker does not need an OpenEMR account. Version 8.0.0.3 patches the issue.
AnalysisAI
A reflected cross-site scripting (XSS) vulnerability exists in the custom template editor of OpenEMR, a widely-deployed open-source electronic health records system. Attackers can craft malicious URLs that, when clicked by authenticated staff members, execute arbitrary JavaScript within their browser sessions and gain access to sensitive medical data and system functions; notably, the attacker does not require an OpenEMR account themselves. The vulnerability affects OpenEMR versions 7.0.2.1 through 8.0.0.2, and while there is no evidence of active exploitation in the wild or public proof-of-concept code, the moderate CVSS score of 6.1 combined with the user-interaction requirement and the context-sensitive nature of healthcare data makes this a meaningful priority for healthcare organizations.
Technical ContextAI
The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting), a foundational web application security flaw. In this case, the custom template editor component of OpenEMR fails to properly sanitize or encode user-supplied input within URL parameters before rendering them in the HTML context of an authenticated user's browser. This allows an attacker to inject malicious JavaScript that executes with the privileges of the authenticated staff member. The issue is classified as a reflected XSS (not stored) because the payload is embedded in the URL itself and reflected back by the server without proper output encoding. The affected product is OpenEMR (CPE likely cpe:2.3:a:openemr:openemr), a PHP-based medical practice management and electronic health record system deployed in clinical environments worldwide.
RemediationAI
Immediately upgrade OpenEMR to version 8.0.0.3 or later, which contains the patches committed in https://github.com/openemr/openemr/commit/d5c8d49ef19983472b2d7db0dbebd2dac9d6a200 and https://github.com/openemr/openemr/commit/de9b6eb0da574430e8223c014cf4a05b0adc29d8. For organizations unable to patch immediately, implement defense-in-depth measures: enforce HTTPS and HTTP Strict-Transport-Security (HSTS) headers to prevent man-in-the-middle interception of malicious URLs; restrict access to the OpenEMR custom template editor to trusted IP ranges via firewall or reverse proxy; conduct staff security awareness training to avoid clicking suspicious links; and monitor access logs for unusual activity in the template editor. Additionally, review any custom templates that may have been created recently for signs of injected malicious code. The primary remediation is the vendor-provided patch; there is no effective workaround that fully mitigates the XSS vulnerability without patching the underlying code.
An authenticated SQL injection vulnerability exists in OpenEMR ≤ 4.1.1 Patch 14 that allows a low-privileged attacker to
Unauthenticated token disclosure in OpenEMR before 8.0.0. CVSS 10.0. PoC and patch available.
Path traversal in OpenEMR 7.0.4 disposeDocument() allows file access. PoC available.
Path traversal in OpenEMR electronic health records before fix allows authenticated users to read arbitrary files on the
SQL injection in OpenEMR electronic health records before fix. Authenticated users can execute arbitrary SQL through the
OpenEMR 7.0.2 is vulnerable to SQL Injection via \openemr\library\classes\Pharmacy.class.php, \controllers\C_Pharmacy.cl
An issue in OpenEMR 7.0.2 allows a remote attacker to escalate privileges viaa crafted POST request using the noteid par
Information disclosure in OpenEMR 5.0.2 to before 8.0.0 exposes sensitive data. PoC and patch available.
interface/fax/fax_dispatch.php in OpenEMR 4.1.0 allows remote authenticated users to execute arbitrary commands via shel
interface/globals.php in OpenEMR 2.x, 3.x, and 4.x before 4.2.0 patch 2 allows remote attackers to bypass authentication
Authentication bypass vulnerability in portal/account/register.php in versions of OpenEMR before 5.0.1.4 allows a remote
OpenEMR 5.0.0 and prior allows low-privilege users to upload files of dangerous types which can result in arbitrary code
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today