CVE-2026-32118: OpenEMR has Stored XSS in Graphical Pain Map legend via unescaped annotation text
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, stored cross-site scripting (XSS) in the Graphical Pain Map ("clickmap") form allows any authenticated clinician to inject arbitrary JavaScript that executes in the browser of every subsequent user who views the affected encounter form. Because session cookies are not marked HttpOnly, this enables full session hijacking of other users, including administrators. This vulnerability is fixed in 8.0.0.1.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32118?
The severity of CVE-2026-32118 is considered high due to the potential for stored cross-site scripting (XSS) attacks.
How do I fix CVE-2026-32118?
To fix CVE-2026-32118, update OpenEMR to version 8.0.0.1 or later, which addresses the stored XSS vulnerability.
What is stored XSS as described in CVE-2026-32118?
Stored XSS in CVE-2026-32118 refers to the injection of malicious scripts into the Graphical Pain Map legend, which can be executed by other users.
Who is affected by CVE-2026-32118?
Users of OpenEMR versions prior to 8.0.0.1 are affected by CVE-2026-32118 and should take action to mitigate the vulnerability.
What functionality is impacted by CVE-2026-32118?
CVE-2026-32118 impacts the Graphical Pain Map functionality, specifically through unescaped annotation text that can lead to XSS exploits.