CVE-2026-67612: OpenEMR Stored XSS Vulnerability

CVE-2026-67612 Overview

CVE-2026-67612 is a stored cross-site scripting (XSS) vulnerability in OpenEMR through version 8.2.0. The flaw resides in the patient portal template management system, where the template save routine only strips literal PHP open tags and fails to sanitize HTML or JavaScript. Authenticated administrators can store malicious payloads that execute when any admin, clinician, or portal patient retrieves the template. Missing HttpOnly cookie attributes allow the injected script to read document.cookie, enabling session hijacking. The weakness is classified as [CWE-79].

Critical Impact
Stored JavaScript in portal templates executes in the browser of every user who loads the poisoned template, enabling session token theft and account takeover across admin, clinician, and patient roles.

Affected Products

OpenEMR through 8.2.0
OpenEMR patient portal template management component (import_template.php)
Deployments serving templates without output encoding or HttpOnly cookies

Discovery Timeline

2026-08-03 - CVE-2026-67612 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-67612

Vulnerability Analysis

OpenEMR exposes a template management workflow through import_template.php in the patient portal subsystem. When an authenticated administrator submits a template in save mode, the server-side handler applies a single filter that removes literal <?php open tags. It performs no HTML entity encoding, no allowlist filtering of tags or attributes, and no sanitization of JavaScript event handlers. Any <script> block, <img onerror> payload, or inline event attribute is preserved verbatim in storage. The retrieval endpoint then emits the stored template into the response body without contextual output encoding, so the browser parses and executes the injected markup.

Session cookies issued by the affected OpenEMR builds are not marked HttpOnly. Injected JavaScript can therefore read document.cookie and transmit the session identifier to an attacker-controlled endpoint using fetch or an image beacon. The stolen token authenticates the attacker as the victim, whether that victim is an administrator, clinician, or portal patient.

Root Cause

The root cause is incomplete input filtering combined with missing output encoding, a classic dual failure pattern for stored XSS. Filtering only <?php tokens addresses server-side template injection but leaves the client-side attack surface untouched. The absence of HttpOnly on session cookies compounds the impact by removing the browser-level defense against cookie exfiltration.

Attack Vector

Exploitation requires an authenticated account with template editing privileges, which the CVSS vector reflects as high privileges required and passive user interaction. The attacker saves a template containing an XSS payload. When any user later loads the poisoned template, the script runs in the victim's authenticated session context. The vulnerability manifests entirely through the standard web interface and requires no additional tooling. Refer to the Jiva Security XSS Writeup and the VulnCheck OpenEMR Advisory for the disclosed payload structure and endpoint details.

Detection Methods for CVE-2026-67612

Indicators of Compromise

Template records in the OpenEMR database containing <script>, onerror=, onload=, or javascript: substrings.
Outbound HTTP requests from clinician or patient browsers to unfamiliar domains immediately after loading a template page.
Session cookie values appearing in web server access logs as query string parameters on external hosts.
Web server POST requests to import_template.php in save mode originating from unexpected administrator accounts.

Detection Strategies

Query the templates table for stored payloads matching HTML tag or event-handler patterns and review any matches manually.
Deploy Content Security Policy (CSP) violation reporting to surface inline script execution attempts on portal template pages.
Correlate import_template.php write events with the accessing user, source IP, and template diff to flag unexpected modifications.
Alert on browser telemetry showing document.cookie access from portal pages that should not read cookies client-side.

Monitoring Recommendations

Enable full HTTP request logging on the OpenEMR web tier and retain bodies for template save operations.
Monitor administrator account creation, role changes, and template edits with tamper-evident audit logs.
Track egress from user workstations that access the portal for connections to newly registered or low-reputation domains.

How to Mitigate CVE-2026-67612

Immediate Actions Required

Restrict template editing permissions to a minimal set of trusted administrators until a patched release is deployed.
Audit existing templates for embedded HTML, script tags, and event-handler attributes, and purge any unauthorized content.
Invalidate active sessions and force password rotation for any account whose session token may have been exposed.
Configure the web server or application to set HttpOnly and Secure flags on all session cookies.

Patch Information

No vendor patch identifier is listed in the enriched CVE data at publication time. Track the VulnCheck OpenEMR Advisory and the OpenEMR project release notes for a fixed version above 8.2.0, and apply it once available.

Workarounds

Place OpenEMR behind a web application firewall rule that blocks HTML tag payloads submitted to import_template.php.
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to the application origin.
Set session cookies to HttpOnly; Secure; SameSite=Lax at the reverse proxy layer to blunt cookie theft even if XSS fires.
Segment portal template administration to a dedicated management network reachable only through authenticated VPN.

bash

# Configuration example: harden session cookies at an Nginx reverse proxy
proxy_cookie_flags ~ HttpOnly Secure SameSite=Lax;

# Add a baseline Content Security Policy for the portal
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'" always;