PT-2026-21817 · Openemr · Openemr

Published 2026-02-25 · Updated 2026-02-25 · CVE-2025-68277

Positive Technologies (AI Summary)

CVSS v4.0

7.2

High

Base vector

AV:L/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:L/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 7.0.4

Description OpenEMR is an electronic health records and medical practice management application. Prior to version 7.0.4, clicking a link sent via Secure Messaging opens the website within the OpenEMR/Portal site, which could be exploited for phishing attacks. The application does not sanitize or validate the URLs within secure messages. This allows an attacker to craft a malicious link that appears legitimate within the OpenEMR interface, potentially leading users to enter sensitive information on a fraudulent website. The vulnerable functionality involves the handling of links within the Secure Messaging feature.

Recommendations Update to version 7.0.4 or later.

Exploit

Fix

UI Misrepresentation of Critical Information

Weakness Enumeration

CWE-451

Related Identifiers

CVE-2025-68277

GHSA-566C-8C52-2JCH

Affected Products

Openemr

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68277.json · Exploit
• https://github.com/openemr/openemr/commit/11ec62d1683571a629734fba66f7fb68d0bdc312 · Patch
• https://github.com/openemr/openemr/security/advisories/GHSA-566c-8c52-2jch · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-68277 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68277 · Security Note
• https://t.me/CVEtracker/45669 · Telegram Post
• https://twitter.com/CVEnew/status/2026641392009638079 · Twitter Post