PT-2026-21822 · Openemr · Openemr

Bradymiller · Published 2026-02-25 · Updated 2026-02-25 · CVE-2026-21443

Positive Technologies · (AI Summary)

CVSS v3.1

6.1

Medium

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.0.0

Description OpenEMR is an electronic health records and medical practice management application. Before version 8.0.0, the xl() translation function does not properly escape strings. The application includes wrapper functions for escaping in different contexts (xlt() for HTML, xla() for attributes, xlj() for JavaScript), but the xl() function’s output is sometimes used directly without escaping. If an attacker can inject malicious content into the translation database, this could lead to cross-site scripting (XSS). The xl() function is used to retrieve translated strings.

Recommendations Update to version 8.0.0 or later.

Exploit

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

CVE-2026-21443

GHSA-3F9J-CQJJ-7H46

Affected Products

Openemr

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21443.json · Exploit
• https://github.com/openemr/openemr/security/advisories/GHSA-3f9j-cqjj-7h46 · Vendor Advisory
• https://github.com/openemr/openemr/commit/b1e3fe8a9ed8bcaf17e0b73d7fad5434f9fe36da · Patch
• https://osv.dev/vulnerability/CVE-2026-21443 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-21443 · Security Note
• https://twitter.com/CVEnew/status/2026641389950251218 · Twitter Post