Description

OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in the patient portal template import handler that allows authenticated attackers with Forms Administration permissions to upload template files containing arbitrary HTML or JavaScript. Attackers can inject malicious scripts through the template upload functionality, which are stored without sanitization and execute in the browser of any other Forms Administration user who views the template in the HTML editor.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-19T15:17:01.707Z",
  "pubdate": "2026-08-19T15:17:01.707Z",
  "executiveSummary": "OpenEMR before 8.3.0 is affected by a stored cross-site scripting (XSS) vulnerability located within the patient portal template import handler. This security flaw enables authenticated attackers possessing Forms Administration permissions to upload malicious template files containing arbitrary HTML or JavaScript payloads. The core risk centers around the lack of proper input sanitization and output encoding during the template upload and rendering process. When another user with Forms Administration privileges accesses the uploaded template via the HTML editor, the injected malicious scripts execute persistently within their browser session. This compromises the integrity and confidentiality of the administrative user's session, potentially leading to unauthorized administrative actions, session hijacking, or further lateral movement within the application ecosystem. The exploitation of this vulnerability strictly requires administrative authentication, specifically targeted permissions related to Forms Administration, and interaction from a privileged user viewing the affected template.",
  "technicalDetails": "The vulnerability resides in the patient portal template import handler component of OpenEMR, specifically impacting versions prior to 8.3.0. The root cause of the flaw is the deficient input sanitization and absence of rigorous validation mechanisms on uploaded template files. When an authenticated user with Forms Administration privileges interacts with the template import functionality, the application accepts and stores the payload containing arbitrary HTML or JavaScript without properly stripping or neutralizing dangerous executable tags and event handlers.\nThe attack flow begins with an authenticated attacker who has acquired or been granted Forms Administration privileges. The attacker crafts a malicious template file embedded with arbitrary JavaScript payloads. Using the application's built-in template upload functionality, the attacker submits this file to the server. The application stores the file persistently in its backend data repository without performing necessary sanitization operations. Subsequently, when any other Forms Administration user navigates to the HTML editor and views the compromised template, the stored script is rendered directly into the Document Object Model (DOM).\nBecause the payload executes directly within the context of the victim's browser session, the malicious script inherits the victim's privileges and session tokens. This enables post-exploitation impacts such as executing unauthorized actions on behalf of the administrator, modifying system configurations, or exfiltrating sensitive session data. The vulnerability requires valid authentication, specific role-based permissions (Forms Administration), and relies on a form of social engineering or routine administrative workflow where another privileged user views the poisoned template within the integrated HTML editor interface."
}