CVE-2026-25743: OpenEMR Stored XSS Vulnerability

CVE-2026-25743 Overview

OpenEMR is a free and open source electronic health records and medical practice management application. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 8.0.0 that affects users with the "Forms administration" role. The vulnerability allows authenticated attackers with this specific role to inject arbitrary JavaScript code into the system through malicious payloads in form answers. When other users with the Forms administration role view these form answers in patient encounter pages or visit history, the malicious JavaScript code is executed in their browser context.

Critical Impact

Authenticated attackers can execute arbitrary JavaScript in the context of other healthcare workers' sessions, potentially compromising patient data confidentiality, manipulating medical records, or escalating privileges within the healthcare management system.

Affected Products

• OpenEMR versions prior to 8.0.0
• OpenEMR Forms administration module
• OpenEMR patient encounter and visit history features

Discovery Timeline

• 2026-02-25 - CVE CVE-2026-25743 published to NVD
• 2026-02-25 - Last updated in NVD database

Technical Details for CVE-2026-25743

Vulnerability Analysis

This stored XSS vulnerability occurs in the function responsible for displaying form answers within OpenEMR. The application fails to properly sanitize user-supplied input when questionnaire responses are stored and subsequently rendered on patient encounter pages and visit history views. Because the vulnerability is stored rather than reflected, the malicious payload persists in the database and executes every time an authorized user views the affected form answers.

The attack requires authentication and the "Forms administration" role, which limits the attack surface to authorized healthcare workers. However, in a healthcare environment, successful exploitation could lead to session hijacking, unauthorized access to protected health information (PHI), manipulation of medical records, or further privilege escalation within the system.

Root Cause

The root cause is improper input validation and output encoding in the QuestionnaireResponseService.php component. User-supplied form answer data is stored without adequate sanitization and rendered to the page without proper HTML entity encoding, allowing embedded script tags and JavaScript event handlers to execute in the victim's browser.

Attack Vector

The attack is network-based and requires the attacker to have authenticated access with the "Forms administration" role. The attacker creates or modifies form answers containing malicious JavaScript payloads. When another user with the same role navigates to view the patient encounter or visit history containing the poisoned form answers, the stored XSS payload executes within their authenticated session.

// Security patch applied to src/Services/QuestionnaireResponseService.php
// Source: https://github.com/openemr/openemr/commit/da18f83f39648edc2463e8810757380a9f1d91de

  * @package   OpenEMR
  * @link      https://www.open-emr.org
  * @author    Jerry Padgett <sjpadgett@gmail.com>
+ * @author    Michael A. Smith <michael@opencoreemr.com>
  * @copyright Copyright (c) 2022 Jerry Padgett <sjpadgett@gmail.com>
+ * @copyright Copyright (c) 2026 OpenCoreEMR Inc <https://opencoreemr.com/>
  * @license   https://github.com/openemr/openemr/blob/master/LICENSE GNU General Public License 3

Source: GitHub Commit da18f83

Detection Methods for CVE-2026-25743

Indicators of Compromise

• Unusual JavaScript patterns in form answer database fields (e.g., <script>, onerror=, onload=)
• Unexpected network requests from user browsers to external domains after viewing patient encounters
• Anomalous session activity or authentication tokens being accessed from multiple IP addresses

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect XSS payloads in form submissions
• Monitor database tables containing form answers for suspicious HTML/JavaScript content
• Review application logs for unusual form submission patterns from users with Forms administration role
• Deploy browser-based XSS detection mechanisms that alert on unexpected script execution

Monitoring Recommendations

• Enable detailed audit logging for all form creation and modification activities
• Configure Content Security Policy (CSP) headers to restrict inline script execution
• Set up alerting for any form answers containing potentially dangerous HTML tags or JavaScript event handlers
• Monitor for abnormal user behavior patterns following form answer views

How to Mitigate CVE-2026-25743

Immediate Actions Required

• Upgrade OpenEMR to version 8.0.0 or later immediately
• Audit existing form answers in the database for signs of malicious JavaScript injection
• Review access logs for users with the "Forms administration" role for suspicious activity
• Consider temporarily restricting the Forms administration role to essential personnel until patching is complete

Patch Information

The vulnerability is fixed in OpenEMR version 8.0.0. The security patch addresses the improper output encoding in src/Services/QuestionnaireResponseService.php. Organizations should apply the update immediately given the sensitive nature of healthcare data handled by OpenEMR. For detailed patch information, see the GitHub Security Advisory GHSA-3xx2-qf6g-6p28 and the security commit da18f83.

Workarounds

• Implement strict Content Security Policy (CSP) headers to mitigate XSS impact by blocking inline script execution
• Deploy a Web Application Firewall (WAF) with XSS detection rules in front of the OpenEMR application
• Limit the number of users with "Forms administration" privileges to reduce the attack surface
• Regularly audit form answer content for suspicious patterns pending the upgrade to version 8.0.0

# Example CSP header configuration for Apache
# Add to OpenEMR Apache configuration or .htaccess
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'self';"