CVE-2026-46518

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.0.0.1

Description A stored cross-site scripting issue exists in the prescription CSS/HTML multi-print feature. Patient portal users can execute arbitrary JavaScript in a clinician's browser session by writing attacker-controlled HTML into patient data via the 'PUT api/patient/:num' endpoint, bypassing the audit review workflow. The multiprintcss header() function renders patient demographic fields, such as name and address, without output encoding. Since the script executes within the clinician's authenticated session on the main interface, an attacker can access session data, CSRF tokens, and perform actions as the clinician.

Recommendations Update to version 8.0.0.1.