CVE-2025-30161: OpenEMR Bronchitis Form Stored XSS Flaw

CVE-2025-30161 Overview

CVE-2025-30161 is a stored cross-site scripting (XSS) vulnerability in the Bronchitis form component of OpenEMR, a widely deployed open source electronic health records (EHR) and medical practice management application. An authenticated user with permission to edit a bronchitis form can inject persistent JavaScript that executes in the browsers of other users, including administrators. Attackers can leverage the flaw to steal administrator credentials or hijack privileged sessions. The issue is tracked under CWE-80 (improper neutralization of script-related HTML tags) and is fixed in OpenEMR 7.0.3.

Critical Impact
Stored XSS in a healthcare records application enables credential theft from administrators and can lead to unauthorized access to protected health information (PHI).

Affected Products

OpenEMR versions prior to 7.0.3
OpenEMR Bronchitis form component (interface/forms/bronchitis/view.php)
Deployments exposing the electronic health record web interface to authenticated clinical users

Discovery Timeline

2025-03-31 - CVE-2025-30161 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30161

Vulnerability Analysis

The vulnerability resides in the Bronchitis clinical form under interface/forms/bronchitis/view.php. Form field values submitted by a user with edit permissions are rendered back into the view template without adequate HTML encoding. When a subsequent user, such as an administrator, opens the affected patient's bronchitis form, the injected payload executes in their authenticated session.

Because the payload persists in the database and runs in the context of the OpenEMR web origin, an attacker can call authenticated API endpoints, exfiltrate session cookies, or inject a keylogger into the admin interface to capture credentials. The vendor advisory documents the vulnerable rendering paths in the view template.

Root Cause

The root cause is missing output encoding of user-controlled data placed into HTML contexts. The referenced code fragments in view.php (lines 102-103 and 303-304) emit form values directly rather than routing them through OpenEMR's HTML escaping helpers. See the OpenEMR GHSA-59rv-645x-rg6p advisory for the specific sinks addressed by the patch.

Attack Vector

Exploitation requires an authenticated account with rights to edit a bronchitis form. The attacker saves a form entry containing a script payload in a vulnerable field. When any higher-privileged user, typically an administrator reviewing patient records, opens the encounter, the stored payload executes. User interaction is required in the form of the victim navigating to the poisoned record, which aligns with the vulnerability being network-reachable, low-complexity, and dependent on victim action.

The vulnerability is described in prose only; no verified proof-of-concept code has been published. Refer to the technical code references in the OpenEMR repository for the vulnerable sinks.

Detection Methods for CVE-2025-30161

Indicators of Compromise

Bronchitis form records in the OpenEMR database containing <script>, onerror=, onload=, javascript:, or encoded variants in text fields
Unexpected outbound HTTP requests from administrator browsers to external hosts shortly after opening a patient encounter
New or modified administrator accounts, password changes, or privilege grants that follow an admin session viewing a bronchitis form
Web server access logs showing repeated edits to interface/forms/bronchitis/ endpoints from a single low-privilege user

Detection Strategies

Query the OpenEMR form_bronchitis table for HTML or JavaScript syntax in free-text fields to identify persisted payloads.
Deploy a Content Security Policy (CSP) in report-only mode and alert on violations originating from bronchitis form pages.
Correlate authenticated form-edit events with subsequent admin session anomalies, such as new API tokens or role changes.

Monitoring Recommendations

Forward OpenEMR web server and application logs to a central analytics platform and alert on script-like patterns in POST bodies targeting form endpoints.
Monitor for administrator sessions initiating unusual privileged actions immediately after opening patient charts.
Track version metadata across OpenEMR instances so any deployment below 7.0.3 is flagged for remediation.

How to Mitigate CVE-2025-30161

Immediate Actions Required

Upgrade all OpenEMR instances to version 7.0.3 or later, which contains the vendor fix.
Audit existing bronchitis form entries for stored script content and sanitize or purge any malicious payloads.
Rotate credentials and active sessions for administrator accounts that may have viewed suspicious bronchitis records.
Review user permissions and remove edit rights on clinical forms from accounts that do not require them.

Patch Information

The vulnerability is fixed in OpenEMR 7.0.3. The remediation is documented in the GitHub Security Advisory GHSA-59rv-645x-rg6p. Administrators should follow the standard OpenEMR upgrade procedure and validate that the interface/forms/bronchitis/view.php file matches the patched revision after upgrading.

Workarounds

Restrict access to the bronchitis form to a minimal set of trusted clinical users until the upgrade is applied.
Deploy a strict Content Security Policy that disallows inline scripts on OpenEMR pages to reduce the impact of stored XSS.
Place a web application firewall (WAF) in front of OpenEMR with rules to block script tags and common XSS payloads in form submissions.
Require administrators to use a separate browser profile or session when reviewing patient encounters authored by lower-privileged users.

bash

# Example CSP header to mitigate stored XSS execution in OpenEMR
# Add to the web server configuration serving OpenEMR
Content-Security-Policy: default-src 'self'; \
  script-src 'self'; \
  object-src 'none'; \
  base-uri 'self'; \
  frame-ancestors 'self'