OpenEMR
CVE-2026-46518
HIGH
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Network-reachable stored XSS exploitable by a low-privileged portal user (PR:L); requires clinician to open multi-print view (UI:R); scope changes to clinician UI with high C/I, no availability impact.
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Lifecycle Timeline
5DescriptionNVD
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.1, a stored cross-site scripting vulnerability in the prescription CSS/HTML multi-print feature allows a patient portal user to execute arbitrary JavaScript in a clinician's browser session. Patient demographic fields (name, address) are rendered without output encoding in multiprintcss_header(), and portal patients can write attacker-controlled HTML directly into patient_data by calling the PUT api/patient/:num endpoint, which bypasses the intended audit review workflow. Because the XSS fires in the clinician's authenticated session on the main OpenEMR interface, the attacker can access CSRF tokens, session data, and perform actions as the clinician - crossing the patient-to-clinician trust boundary. This issue has been patched in version 8.0.0.1.
AnalysisAI
Stored cross-site scripting in OpenEMR before 8.0.0.1 lets an authenticated patient portal user inject HTML/JavaScript into demographic fields via the PUT api/patient/:num endpoint, which fires later in a clinician's authenticated session when the prescription CSS/HTML multi-print feature renders the patient name and address without output encoding. Because the payload executes inside the main OpenEMR UI under the clinician's session, the attacker crosses the patient-to-clinician trust boundary and can steal CSRF tokens, exfiltrate session data, and perform privileged actions as the clinician. SSVC currently rates exploitation as POC, no public exploit identified at time of analysis, and EPSS is 0.03% (9th percentile), but the cross-tenant trust crossing in a healthcare app makes the issue material for any internet-exposed deployment.
Technical ContextAI
OpenEMR is a widely deployed open-source electronic health records and practice management web application written in PHP. The root cause is classic CWE-79 (Improper Neutralization of Input During Web Page Generation) in the multiprintcss_header() function, which concatenates patient demographic strings (name, address) directly into HTML output without HTML-entity encoding. The injection path bypasses OpenEMR's audit-review workflow that normally gates portal-supplied changes to patient_data: the PUT api/patient/:num REST endpoint writes attacker-controlled values straight into the demographics table, so when a clinician later opens the prescription multi-print CSS/HTML view, the stored payload renders into the parent OpenEMR origin. The CPE cpe:2.3:a:openemr:openemr:*:*:*:*:*:*:*:* covers all OpenEMR versions prior to the fixed 8.0.0.1 release.
RemediationAI
Vendor-released patch: upgrade OpenEMR to 8.0.0.1 or later, as described in advisory https://github.com/openemr/openemr/security/advisories/GHSA-4gh4-q39r-45wf. If immediate upgrade is not possible, disable or restrict the patient portal's PUT api/patient/:num endpoint at the reverse proxy / API gateway so portal users cannot directly write demographics (side effect: portal-initiated demographic self-updates will stop working until the patched audit-review workflow is restored), and avoid using the prescription CSS/HTML multi-print feature for patients whose demographics were edited via the portal during the exposure window. Audit existing patient_data name and address fields for HTML/JavaScript content and sanitize stored values before any clinician next opens the multi-print view; enforcing a strict Content-Security-Policy that disallows inline script on the main OpenEMR UI will further reduce blast radius but may break legitimate inline-script usage in older themes.
An authenticated SQL injection vulnerability exists in OpenEMR ≤ 4.1.1 Patch 14 that allows a low-privileged attacker to
Unauthenticated token disclosure in OpenEMR before 8.0.0. CVSS 10.0. PoC and patch available.
Path traversal in OpenEMR 7.0.4 disposeDocument() allows file access. PoC available.
Path traversal in OpenEMR electronic health records before fix allows authenticated users to read arbitrary files on the
SQL injection in OpenEMR electronic health records before fix. Authenticated users can execute arbitrary SQL through the
OpenEMR 7.0.2 is vulnerable to SQL Injection via \openemr\library\classes\Pharmacy.class.php, \controllers\C_Pharmacy.cl
An issue in OpenEMR 7.0.2 allows a remote attacker to escalate privileges viaa crafted POST request using the noteid par
Information disclosure in OpenEMR 5.0.2 to before 8.0.0 exposes sensitive data. PoC and patch available.
interface/fax/fax_dispatch.php in OpenEMR 4.1.0 allows remote authenticated users to execute arbitrary commands via shel
interface/globals.php in OpenEMR 2.x, 3.x, and 4.x before 4.2.0 patch 2 allows remote attackers to bypass authentication
Authentication bypass vulnerability in portal/account/register.php in versions of OpenEMR before 5.0.1.4 allows a remote
OpenEMR 5.0.0 and prior allows low-privilege users to upload files of dangerous types which can result in arbitrary code
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today