OpenEMR: Stored Cross-Site Scripting (CVE-2026-124463)

OpenEMR versions before 8.3.0 contain a stored cross-site scripting (XSS) vulnerability. Authenticated users with CAMOS (Computerized Assisted Medical Office Suite) access can inject malicious HTML or scripts by saving content through the ajax_save.php endpoint. The payload is subsequently executed when a victim accesses the entry via the rx_print.php script (specifically the non-print_html branch), allowing the attacker to perform actions or read data as the authenticated user.

Impact

Successful exploitation allows authenticated attackers to perform unauthorized actions or exfiltrate sensitive data by executing scripts within the browser session of a victim user who views the malicious content.

Recommendation

• Upgrade OpenEMR to version 8.3.0 or later to remediate the vulnerability.
• Audit access controls for the CAMOS module to ensure only trusted users have the ability to save content.
• Monitor web server logs for suspicious POST requests to ajax_save.php containing script-related characters.