PT-2026-67441 · Openemr · Openemr

Jiva · CVE-2026-67612 · Published 2026-08-03 · Updated 2026-08-03

Mitre

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

OpenEMR through 8.2.0 contains a stored cross-site scripting vulnerability in the patient portal template system that allows authenticated administrators to inject arbitrary HTML and JavaScript by storing malicious payloads through the template save mode, which only filters literal PHP open tags. Attackers can exploit the lack of output encoding at the template retrieval endpoint combined with missing HttpOnly cookie attributes to exfiltrate session tokens via document.cookie access, enabling full session hijacking of any admin, clinician, or portal patient who views a poisoned template.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-67612

Affected Products

Openemr

References · 3

• 🔥 https://jivasecurity.com/writeups/openemr-portal-template-stored-xss · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-67612 · Security Note
• https://vulncheck.com/advisories/openemr-stored-xss-via-import-template-php-template-management · Note