CVE-2026-39931

OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in the patient portal template import handler. Authenticated attackers with Forms Administration permissions can upload template files containing arbitrary HTML or JavaScript. Malicious scripts are stored without sanitization and execute in the browser of any other Forms Administration user who views the template in the HTML editor.

OpenEMR through 8.2.0 contains a stored XSS vulnerability in the patient portal template system. Authenticated administrators can inject arbitrary HTML and JavaScript by storing malicious payloads through the template save mode, which only filters literal PHP open tags. Lack of output encoding at the template retrieval endpoint and missing HttpOnly cookie attributes allow session token exfiltration via document.cookie.

OpenEMR through 8.2.0 contains an improper authentication vulnerability in the OAuth2 dynamic client registration endpoint that allows unauthenticated attackers to register a malicious client with system-level FHIR scopes by supplying a self-generated RSA keypair via the jwks field. Once an administrator approves the registered client, attackers can use the client_credentials grant with a self-signed JWT assertion to obtain access tokens granting read access to all FHIR resources across all patients in the system.

OpenEMR version 7.0.1 contains an authentication brute force vulnerability that allows attackers to bypass rate limiting protections. Attackers can send repeated login attempts to the main login endpoint, systematically testing username and password combinations.

The application OpenEMR versions 5.0.0, 5.0.1-dev and prior is affected by a vertical privilege escalation vulnerability. This vulnerability allows authenticated non-administrator users to view and modify information only accessible to administrators.

OpenEMR versions before 5.0.0 Patch 5 allow unauthenticated remote database copying because setup.php exposes functionality for cloning an existing OpenEMR site to an arbitrary attacker-controlled MySQL server via vectors involving a crafted state parameter.

OpenEMR version 5.0.0 and prior allows low-privilege users to upload files of dangerous types, which can lead to arbitrary code execution within the context of the vulnerable application.

OpenEMR through 8.2.0 contains a remote code execution vulnerability in the document category tree component (library/classes/Tree.class.php) that allows authenticated administrators to execute arbitrary operating system commands by injecting PHP payloads into the categories database table. Attackers can chain arbitrary SQL execution to alter the id column type to VARCHAR and insert a malicious PHP payload, which is then executed via an unsanitized eval() call whenever any page instantiates CategoryTree, including unauthenticated and low-privilege pages, resulting in command execution as the web server user.

OpenEMR before version 8.3.0 contains a path traversal vulnerability in the EDI archive restore function. The archrestore_sel parameter is passed without sanitization, and differing response messages leak whether the target path exists. An authenticated user with EOB Data Entry permissions can probe arbitrary filesystem paths.

OpenEMR before 8.3.0 contains a cross-site request forgery vulnerability in the DICOM viewer. The web_path GET parameter is embedded as a URL without validation against expected path formats. An attacker can craft a URL that causes an authenticated user with Patients - Documents permissions to make authenticated requests to arbitrary OpenEMR endpoints, enabling forced logout and other state-changing actions.