Openemr
CVE-2026-33933
MEDIUM
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS 3.1 score of 6.1 reflects a network-accessible vulnerability with low attack complexity, no privilege requirements for the attacker, but user interaction (the staff member must click the malicious link) and changed scope. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N indicates low confidentiality and integrity impact but no availability impact. The real-world risk is moderately elevated due to several factors: (1) OpenEMR is used in sensitive healthcare environments where staff may be socially engineered to click links; (2) a successful attack grants access to medical records and enables privilege escalation within the EHR; (3) the vulnerability requires only network access and user interaction, making it relatively easy to exploit; (4) no active exploitation has been reported in the KEV database, and no public proof-of-concept appears widely available, suggesting this remains a pre-active threat; (5) the patch is readily available in version 8.0.0.3. Overall, this should be prioritized for patching in healthcare organizations, but it is not an imminent emergency compared to unauthenticated remote code execution flaws. Organizations on older versions (7.0.2.1 and above) should upgrade promptly to mitigate social engineering-based attacks. |
| Exploit ScenarioDerived | An attacker researches a healthcare organization's use of OpenEMR and crafts a malicious URL containing JavaScript payload in the custom template editor parameter. The attacker emails a clinic manager with a pretext message (e.g., 'Click here to view your updated template'), embedding the malicious URL. When the authenticated staff member clicks the link, their browser executes the embedded JavaScript, which silently steals their session cookie and forwards it to the attacker's server. The attacker then uses this session cookie to access the OpenEMR system as the staff member, viewing patient records, modifying medical data, or escalating privileges to administrative functions. No public proof-of-concept code has been published, but the reflected XSS nature and low attack complexity mean a skilled attacker could construct and deliver such a payload with minimal effort. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 26, 2026
A reflected cross-site scripting (XSS) vulnerability exists in the custom template editor of OpenEMR, a widely-deployed open-source electronic health records system. Attackers can craft malicious URLs that, when clicked by authenticated staff members, execute arbitrary JavaScript within their browser sessions and gain access to sensitive medical data and system functions; notably, the attacker does not require an OpenEMR account themselves. The vulnerability affects OpenEMR versions 7.0.2.1 through 8.0.0.2, and while there is no evidence of active exploitation in the wild or public proof-of-concept code, the moderate CVSS score of 6.1 combined with the user-interaction requirement and the context-sensitive nature of healthcare data makes this a meaningful priority for healthcare organizations.
RemediationAI
Immediately upgrade OpenEMR to version 8.0.0.3 or later, which contains the patches committed in https://github.com/openemr/openemr/commit/d5c8d49ef19983472b2d7db0dbebd2dac9d6a200 and https://github.com/openemr/openemr/commit/de9b6eb0da574430e8223c014cf4a05b0adc29d8. For organizations unable to patch immediately, implement defense-in-depth measures: enforce HTTPS and HTTP Strict-Transport-Security (HSTS) headers to prevent man-in-the-middle interception of malicious URLs; restrict access to the OpenEMR custom template editor to trusted IP ranges via firewall or reverse proxy; conduct staff security awareness training to avoid clicking suspicious links; and monitor access logs for unusual activity in the template editor. Additionally, review any custom templates that may have been created recently for signs of injected malicious code. The primary remediation is the vendor-provided patch; there is no effective workaround that fully mitigates the XSS vulnerability without patching the underlying code.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting), a foundational web application security flaw. In this case, the custom template editor component of OpenEMR fails to properly sanitize or encode user-supplied input within URL parameters before rendering them in the HTML context of an authenticated user's browser. This allows an attacker to inject malicious JavaScript that executes with the privileges of the authenticated staff member. The issue is classified as a reflected XSS (not stored) because the payload is embedded in the URL itself and reflected back by the server without proper output encoding. The affected product is OpenEMR (CPE likely cpe:2.3:a:openemr:openemr), a PHP-based medical practice management and electronic health record system deployed in clinical environments worldwide.
Know when Openemr gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
DescriptionGitHub Advisory
OpenEMR is a free and open source electronic health records and medical practice management application. Starting in version 7.0.2.1 and prior to version 8.0.0.3, a reflected cross-site scripting (XSS) vulnerability in the custom template editor allows an attacker to execute arbitrary JavaScript in an authenticated staff member's browser session by sending them a crafted URL. The attacker does not need an OpenEMR account. Version 8.0.0.3 patches the issue.
Executive ViewAI
Organizations using version 7.0.2.1 and should be aware of moderate risk from CVE-2026-33933, a cross-site scripting vulnerability rated CVSS 6.1. Attackers could inject scripts to steal sessions or perform actions as authenticated users. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: implement CSP headers, enable HttpOnly cookies, deploy WAF XSS rules.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Affected Products (CPE)GitHub Advisory
Related Vulnerabilities in OpenEMR Authorization and XSS Vulnerabilities
View all 6An authenticated SQL injection vulnerability exists in OpenEMR ≤ 4.1.1 Patch 14 that allows a low-privileged attacker to
Unauthenticated token disclosure in OpenEMR before 8.0.0. CVSS 10.0. PoC and patch available.
Path traversal in OpenEMR 7.0.4 disposeDocument() allows file access. PoC available.
Path traversal in OpenEMR electronic health records before fix allows authenticated users to read arbitrary files on the
SQL injection in OpenEMR electronic health records before fix. Authenticated users can execute arbitrary SQL through the
OpenEMR 7.0.2 is vulnerable to SQL Injection via \openemr\library\classes\Pharmacy.class.php, \controllers\C_Pharmacy.cl
An issue in OpenEMR 7.0.2 allows a remote attacker to escalate privileges viaa crafted POST request using the noteid par
Information disclosure in OpenEMR 5.0.2 to before 8.0.0 exposes sensitive data. PoC and patch available.
Remote code execution in OpenEMR through 8.2.0 lets an authenticated administrator poison the document category tree so
interface/fax/fax_dispatch.php in OpenEMR 4.1.0 allows remote authenticated users to execute arbitrary commands via shel
interface/globals.php in OpenEMR 2.x, 3.x, and 4.x before 4.2.0 patch 2 allows remote attackers to bypass authentication
Authentication bypass vulnerability in portal/account/register.php in versions of OpenEMR before 5.0.1.4 allows a remote
Exploit-DB