CVE-2026-67612

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-67612

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-67612.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-67612

Published

2026-08-03T16:06:15.872Z

Modified

2026-08-05T03:30:56.099878170Z

Severity

4.8 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator

Summary

OpenEMR 8.2.0 Stored XSS via import_template.php Template Management

Details

OpenEMR through 8.2.0 contains a stored cross-site scripting vulnerability in the patient portal template system that allows authenticated administrators to inject arbitrary HTML and JavaScript by storing malicious payloads through the template save mode, which only filters literal PHP open tags. Attackers can exploit the lack of output encoding at the template retrieval endpoint combined with missing HttpOnly cookie attributes to exfiltrate session tokens via document.cookie access, enabling full session hijacking of any admin, clinician, or portal patient who views a poisoned template.

Database specific

{
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/67xxx/CVE-2026-67612.json",
    "cna_assigner": "VulnCheck"
}

References

Affected packages

Git / github.com/openemr/openemr

Affected ranges

Type

GIT

Repo

https://github.com/openemr/openemr

Events

Introduced

Last affected

6125a2fd8089c8bcc3848071c1293c60e27a7585

Database specific

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.2.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

Other

v2_7_2

v2_7_2-rc1

v2_7_2-rc2

v2_7_3-rc1

v2_8_0

v2_8_1

v2_8_2

v2_8_3

v2_9_0

v3_0_0

v3_0_1

v8_2_0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-67612.json"