CVE-2026-67612

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.2.1

Description A stored cross-site scripting issue exists in the patient portal template system. Authenticated administrators can inject arbitrary HTML and JavaScript by storing malicious payloads through the template save mode, as the system only filters literal PHP open tags. The lack of output encoding at the template retrieval endpoint, combined with missing HttpOnly cookie attributes, allows the exfiltration of session tokens via document.cookie access. This can lead to full session hijacking of any administrator, clinician, or portal patient who views a poisoned template.

Recommendations Update to version 8.2.1 or later.