CVE-2026-126484: OpenEMR before 8.5.0 Stored XSS via Printed Fee Sheet Appointment Comments
OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in printedfeesheet.php that allows authenticated portal patients to inject script by setting unescaped appointment comments (pchometext). Attackers can submit HTML payloads via the formcomments field in addediteventuser.php that execute when staff open the patient's fee sheet, acting within the staff session.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue, and who is at risk from the resulting script execution?
An authenticated portal patient can submit a malicious appointment comment. The payload executes when a staff member opens that patient’s fee sheet, in the context of the staff member’s session.
What interaction is required for exploitation?
The attacker must be able to authenticate as a portal patient and submit HTML through the appointment-comment form. A staff member must then open the affected patient’s fee sheet for the stored payload to execute.
Are installations running OpenEMR 8.5.0 affected?
The issue is identified as affecting OpenEMR versions before 8.5.0. The provided information does not identify 8.5.0 as affected.