CVE-2026-103935: OpenEMR: Stored XSS via `text()` Misuse in Double-Quoted HTML Attribute
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/forms/transfersummary/new.php and interface/forms/functionalcognitivestatus/new.php render stored transferto, code, and codetext values with text(), which uses ENTNOQUOTES, inside double-quoted HTML value attributes. An authenticated clinical user can store a value containing a double quote that escapes the attribute and injects event-handler markup when another clinician opens the form. Successful exploitation can expose session data and protected health information or permit patient-record actions in the victim's session. This issue is fixed in version 8.3.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenEMRto a version that resolves this vulnerability.Fixed in 8.3.0
Event History
Frequently Asked Questions
Who can exploit this issue, and who is at risk from the injected content?
An authenticated clinical user can store a crafted value in the affected transfer summary or functional/cognitive status forms. Another clinician is exposed when they open the form containing that stored value.
What does an attacker need to include in a stored value?
The attacker needs a value containing a double quote so it escapes the double-quoted HTML value attribute, followed by event-handler markup. The vulnerable rendering affects transfer_to, code, and codetext values.
What is the impact if exploitation succeeds?
Injected script can expose the viewing clinician's session data and protected health information. It may also allow patient-record actions using that clinician's session.
Which versions are affected and what is the remediation?
OpenEMR versions prior to 8.3.0 are affected. Upgrade to version 8.3.0, which fixes the issue.