CVE-2026-124452: OpenEMR before 8.3.0 Stored XSS via Eye Exam Document Notes

Published Nov 8, 2026

Updated

OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in interface/forms/eyemag/report.php that allows authenticated users to inject scripts by adding unescaped document notes. Attackers with document-note write access can store malicious JavaScript in a retina document note that executes when clinicians generate the Eye Exam patient report, exposing session cookies.

Event History

Nov 8, 2026

CVE Published

via MITRE·01:15 PM

Data Sourced

via MITRE·01:15 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

OpenEMR deployments before 8.3.0 are exposed when users can write retina document notes and clinicians generate Eye Exam patient reports. The malicious script runs in the clinician's browser when that report is generated.

What access does an attacker need to exploit it?

The attacker must be authenticated and have permission to add or modify document notes. Exploitation also requires a clinician or other user to generate the affected Eye Exam patient report.

Are default configurations affected?

The available information does not establish whether document-note write access is granted in a default configuration. Exposure depends on whether authenticated users have that permission and use the Eye Exam reporting workflow.

How can I tell whether an instance is affected?

Instances running a version before 8.3.0 are affected by the described vulnerable code path. Review whether users can add retina document notes and whether clinicians generate Eye Exam patient reports.

CVE-2026-124452: OpenEMR before 8.3.0 Stored XSS via Eye Exam Document Notes

Event History

Frequently Asked Questions

Who is exposed to this issue?

What access does an attacker need to exploit it?

Are default configurations affected?

How can I tell whether an instance is affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What access does an attacker need to exploit it?

Are default configurations affected?

How can I tell whether an instance is affected?