CVE-2026-126418: OpenEMR before 8.5.0 Stored XSS via Billing Code in sl_eob_invoice.php
OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in interface/billing/sleobinvoice.php, which escapes billing codes for HTML attributes but not for JavaScript strings in an inline onkeyup handler. Clinicians with encounter coding access can save crafted billing codes through diagnosis.php that execute script when a Back Office user enters a payment, exposing patient and financial data or performing actions as that user.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue, and which users are exposed to the payload?
A clinician with encounter coding access can save a crafted billing code through diagnosis.php. The payload executes when a Back Office user enters a payment in the affected billing workflow.
What access and interaction are required for exploitation?
The attacker needs clinician-level access that permits encounter coding and must store a malicious billing code. A Back Office user must subsequently enter a payment, which triggers the inline onkeyup handler containing the unescaped value.
Are deployments on the fixed release affected?
The issue affects OpenEMR versions before 8.5.0. OpenEMR 8.5.0 is not identified as affected by the provided information.
What could an attacker do after the script executes?
The script executes in the Back Office user's context and can expose patient and financial data. It may also perform actions as that user.