CVE-2026-32118: OpenEMR Stored XSS Vulnerability

CVE-2026-32118 Overview

CVE-2026-32118 is a stored Cross-Site Scripting (XSS) vulnerability in OpenEMR, a widely-used free and open source electronic health records (EHR) and medical practice management application. The vulnerability exists in the Graphical Pain Map ("clickmap") form functionality and allows any authenticated clinician to inject arbitrary JavaScript that executes in the browser of every subsequent user who views the affected encounter form.

This vulnerability is particularly concerning in healthcare environments where OpenEMR manages sensitive patient data. Because session cookies are not marked HttpOnly, successful exploitation enables full session hijacking of other users, including administrators, potentially compromising the entire EHR system.

Critical Impact

Authenticated attackers can hijack administrator sessions through persistent XSS in the clickmap form, potentially gaining full control over the OpenEMR installation and accessing protected health information (PHI).

Affected Products

• OpenEMR versions prior to 8.0.0.1

Discovery Timeline

• 2026-03-11 - CVE CVE-2026-32118 published to NVD
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2026-32118

Vulnerability Analysis

This stored XSS vulnerability (CWE-79) resides in the Graphical Pain Map feature, which allows clinicians to document patient pain locations visually through an interactive "clickmap" interface. The application fails to properly sanitize user-supplied input before storing it in the database and subsequently rendering it in the browser when other users view the encounter form.

The attack is particularly effective because it targets a workflow component that is routinely accessed by multiple clinical staff members reviewing patient encounters. When a malicious clinician enters a crafted payload into the clickmap form fields, that payload is persistently stored and executed each time another user views the affected encounter.

The absence of the HttpOnly flag on session cookies significantly amplifies the impact. This security misconfiguration allows JavaScript code to access document.cookie, enabling attackers to exfiltrate session tokens and perform full session hijacking. An attacker could impersonate administrators, access sensitive patient records, modify medical data, or create backdoor accounts.

Root Cause

The root cause of this vulnerability is improper input validation and output encoding in the Graphical Pain Map form processing code. User-supplied data from the clickmap interface is stored without sufficient sanitization and later rendered in HTML contexts without proper encoding, allowing embedded JavaScript to execute in victims' browsers.

Additionally, the lack of HttpOnly cookie flags on session cookies represents a defense-in-depth failure that transforms what might otherwise be a limited XSS attack into a full session hijacking scenario.

Attack Vector

The attack vector is network-based and requires low-privilege authenticated access to the OpenEMR system. An attacker needs a valid clinician account to access the encounter forms and Graphical Pain Map functionality.

The attack flow proceeds as follows:

1. Attacker authenticates to OpenEMR with valid clinician credentials
2. Attacker navigates to a patient encounter and accesses the Graphical Pain Map form
3. Attacker injects malicious JavaScript into clickmap form fields
4. The payload is stored in the database
5. When other users (including administrators) view the same encounter form, the malicious script executes
6. The script can steal session cookies and send them to an attacker-controlled server
7. Attacker uses stolen session tokens to impersonate victims

For technical details on the vulnerability and exploitation mechanics, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-32118

Indicators of Compromise

• Unusual JavaScript patterns in encounter form data, particularly in clickmap-related database fields
• Outbound HTTP requests from client browsers to unknown external domains during encounter form viewing
• Session tokens appearing in web server access logs from unexpected IP addresses
• Multiple users accessing the system from the same session identifier

Detection Strategies

• Implement Content Security Policy (CSP) headers and monitor for CSP violation reports indicating XSS attempts
• Deploy Web Application Firewall (WAF) rules to detect common XSS patterns in form submissions
• Review database entries in clickmap-related tables for script tags, event handlers, or encoded JavaScript patterns
• Monitor authentication logs for session anomalies such as geographic impossibilities or concurrent sessions

Monitoring Recommendations

• Enable detailed logging for the encounter forms module, particularly the clickmap functionality
• Set up alerts for any <script> tags or JavaScript event handlers appearing in form submission data
• Monitor for unusual patterns of encounter form access, especially if multiple high-privilege accounts access the same record in quick succession
• Implement browser-based XSS detection through CSP reporting endpoints

How to Mitigate CVE-2026-32118

Immediate Actions Required

• Upgrade OpenEMR to version 8.0.0.1 or later immediately
• Audit existing encounter forms for potentially malicious JavaScript payloads in clickmap data
• Invalidate all active sessions to prevent exploitation of any stolen session tokens
• Configure HttpOnly and Secure flags on session cookies as an additional defense measure

Patch Information

The vulnerability has been fixed in OpenEMR version 8.0.0.1. Organizations should upgrade to this version or later to remediate the vulnerability. The security fix addresses the input validation issues in the Graphical Pain Map form and implements proper output encoding to prevent XSS attacks.

For detailed patch information, see the GitHub Security Advisory.

Workarounds

• Restrict access to the Graphical Pain Map form functionality to trusted users only until patching is complete
• Implement a Web Application Firewall (WAF) with XSS filtering rules as a temporary mitigation
• Manually add HttpOnly and Secure flags to session cookies in the PHP configuration
• Consider temporarily disabling the clickmap form feature if it is not critical to clinical workflows

# PHP configuration to enhance session cookie security
# Add to php.ini or OpenEMR's local configuration
session.cookie_httponly = 1
session.cookie_secure = 1
session.cookie_samesite = Strict