CVE-2026-67612: OpenEMR 8.2.0 Stored XSS via import_template.php Template Management
OpenEMR through 8.2.0 contains a stored cross-site scripting vulnerability in the patient portal template system that allows authenticated administrators to inject arbitrary HTML and JavaScript by storing malicious payloads through the template save mode, which only filters literal PHP open tags. Attackers can exploit the lack of output encoding at the template retrieval endpoint combined with missing HttpOnly cookie attributes to exfiltrate session tokens via document.cookie access, enabling full session hijacking of any admin, clinician, or portal patient who views a poisoned template.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenEMRto a version that resolves this vulnerability.Fixed in 8.2.0 - Compensating control
Mitigate the impact by limiting exposure of the template management/import function (e.g., restrict access to template retrieval/import_template.php and template save mode to trusted administrator accounts and to trusted networks via ACL/firewall).
Event History
Frequently Asked Questions
What is CVE-2026-67612?
CVE-2026-67612 is a stored cross-site scripting vulnerability in OpenEMR versions through 8.2.0 that allows authenticated administrators to inject malicious HTML and JavaScript.
What is the severity of CVE-2026-67612?
The severity of CVE-2026-67612 is classified as medium with a CVSS score of 4.8.
How do I fix CVE-2026-67612?
To mitigate CVE-2026-67612, users should upgrade to the latest version of OpenEMR that addresses this vulnerability.
What types of attacks can be performed using CVE-2026-67612?
CVE-2026-67612 allows attackers to execute arbitrary JavaScript in the context of an authenticated user's session, potentially leading to data theft and other malicious actions.
Who is affected by CVE-2026-67612?
Authenticated administrators using OpenEMR versions through 8.2.0 are affected by CVE-2026-67612 due to the vulnerability in the patient portal template system.