Executive brief
OpenEMR is an open-source medical practice management and electronic health records platform. A security flaw allows malicious patients to inject malicious code into their own profile information by bypassing the standard review process. When a healthcare provider later attempts to print a prescription for that patient using specific templates, the malicious code executes in the provider's browser, potentially allowing the attacker to steal session data or perform unauthorized actions as a clinician.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in OpenEMR's prescription CSS/HTML multi-print feature due to missing output encoding in the multiprintcss_header() function within controllers/C_Prescription.class.php. An attacker with patient portal access can exploit this by making a direct PUT request to the 'api/patient/:num' endpoint, which bypasses the intended 'api/portalpatient' audit workflow and writes unvalidated HTML/JavaScript directly to the patient_data table. When a clinician views the affected patient's prescription in the multi-print view, the payload executes in their authenticated session. This allows the attacker to cross the patient-to-clinician trust boundary, potentially accessing CSRF tokens and session cookies. The issue is patched in version 8.0.0.1.
Affected products
- OpenEMR OpenEMR < 8.0.0.1
Timeline
- 2026-03-11: advisory: GitHub Security Advisory published
- 2026-06-10: disclosed: NVD publication date