CVE-2026-126451: OpenEMR before 8.5.0 Stored XSS via Document Template Rendering
OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows portal patients to run JavaScript in staff sessions by injecting javascript: URLs into document templatedata. Attackers can submit an encounterForm value rendered unsanitized into an iframe src by DocumentTemplateRender, letting the script read PHI and CSRF tokens and call staff or admin endpoints.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A portal patient who can submit an encounterForm value can inject a javascript: URL into document template_data. Exploitation requires a staff member to render the affected document template in their session.
What can the injected script access or do in a staff session?
The script can read protected health information and CSRF tokens available to the staff user. It can also make requests to staff or administrator endpoints with that user's session.
Are administrators the only users at risk?
No. The issue affects staff sessions that render the malicious template; administrator endpoints may also be reachable if the victim session has the required privileges.
Which versions are affected?
OpenEMR versions before 8.5.0 are affected.