CVE-2025-31121: OpenEMR allows XSS in Patient Image feature
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 7.0.3.1, the Patient Image feature in OpenEMR is vulnerable to cross-site scripting attacks via the EXIF title in an image. This vulnerability is fixed in 7.0.3.1.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-31121?
CVE-2025-31121 is rated as a medium severity vulnerability due to its potential risk for cross-site scripting attacks.
How do I fix CVE-2025-31121?
To fix CVE-2025-31121, upgrade OpenEMR to version 7.0.3.1 or higher where the vulnerability has been patched.
What is the main impact of CVE-2025-31121?
The main impact of CVE-2025-31121 is the possibility of executing malicious scripts in the context of a user's session through the Patient Image feature.
Which versions of OpenEMR are affected by CVE-2025-31121?
OpenEMR versions prior to 7.0.3.1 are affected by CVE-2025-31121.
Are there any known exploits for CVE-2025-31121?
As of now, there are no publicly disclosed exploits specifically targeting CVE-2025-31121.