Description

OpenEMR before 8.3.0 contains a reflected cross-site scripting vulnerability in the patient portal template import handler. The templateHtml GET parameter is reflected into the page response without sanitization. An attacker can craft a URL that executes arbitrary JavaScript in the browser of any authenticated user with Forms Administration permissions who visits the link, enabling session hijacking.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-19T15:17:01.530Z",
  "pubdate": "2026-08-19T15:17:01.530Z",
  "executiveSummary": "OpenEMR before 8.3.0 suffers from a reflected cross-site scripting (XSS) vulnerability located within the patient portal template import handler. The flaw arises due to the direct reflection of user-supplied input via the templateHtml GET parameter into the Hypertext Markup Language response without adequate output encoding or input sanitization.\nThe security impact of this vulnerability involves the execution of arbitrary JavaScript code within the context of a victim's browser session. Successful exploitation enables session hijacking, allowing malicious actors to compromise authenticated user sessions, access sensitive health records, and potentially escalate privileges within the application.\nThe affected product is OpenEMR across versions prior to 8.3.0. Risk implications are significant for healthcare environments utilizing the platform, as patient confidentiality and system integrity are directly threatened.\nAttacker capabilities include the ability to craft malicious Uniform Resource Locators containing arbitrary script payloads designed to target specific users. Exploitation requirements mandate that a targeted user must be authenticated into the system with Forms Administration permissions and must actively visit the crafted hyperlink supplied by the attacker.",
  "technicalDetails": "The root cause of the vulnerability is the absence of input sanitization and context-aware output encoding on the templateHtml parameter handled by the patient portal template import handler component within OpenEMR before version 8.3.0.\nVulnerable component: The patient portal template import handler processes GET requests containing the templateHtml parameter. Because the application blindly reflects the contents of this parameter directly into the Document Object Model of the resulting page response, malicious script inputs are rendered natively by the web browser.\nAttack vector and network exposure: The vulnerability is exploitable over the network via HTTP GET requests. An attacker must deliver a specially crafted URL to a victim, typically through phishing vectors, social engineering, or stored injection points if applicable.\nAuthentication and privilege requirements: Exploitation requires the target user to be authenticated to the OpenEMR instance. Furthermore, the targeted user must hold specific privilege levels, specifically Forms Administration permissions, increasing the sensitivity of the targeted administrative context.\nStep-by-step attack flow: 1. The attacker crafts a malicious URL pointing to the vulnerable OpenEMR endpoint, appending an arbitrary JavaScript payload to the templateHtml GET parameter. 2. The attacker delivers the crafted link to an authenticated OpenEMR user who possesses Forms Administration permissions. 3. The victim clicks the link, sending an HTTP GET request to the OpenEMR server containing the malicious payload. 4. The vulnerable patient portal template import handler processes the request and reflects the unsanitized templateHtml parameter value directly into the Hypertext Markup Language response body. 5. The victim's web browser receives the response and executes the embedded JavaScript within the security context of the authenticated session.\nPayload behavior and post-exploitation impact: Executed JavaScript payloads can interact with Document Object Model elements, access document.cookie objects containing session identifiers, perform unauthorized actions on behalf of the administrator via Asynchronous JavaScript and XML or Fetch requests, and facilitate full session hijacking. This compromises the confidentiality and integrity of the OpenEMR deployment."
}