CVE-2026-46518: OpenEMR: Stored XSS in prescription CSS/HTML print view via patient demographics

Synopsis

Stored cross-site scripting (XSS) in OpenEMR affects the prescription CSS/HTML multi-print feature, reachable over the network by a low-privilege patient portal account. A patient-portal user can write attacker-controlled HTML into their own demographic fields via the PUT api/patient/:num endpoint, bypassing audit review; when a clinician opens the print view, the injected script executes inside the clinician's authenticated browser session. Successful exploitation lets the attacker read CSRF tokens and session data, and perform actions as the clinician, crossing the patient-to-clinician trust boundary. A patched-image rebuild at version 8.0.0.1 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker reaches the OpenEMR patient portal API over the network; the service must be exposed to the attacker's network path.

• AuthenticationRequired

  A low-privilege patient portal account is sufficient; no administrative credentials are needed, but the attacker must be a registered portal user.

• Victim interactionRequired

  A clinician must open the prescription CSS/HTML print view for the injected script to execute; the attacker depends on that user action to trigger the XSS payload.

• Attack complexityDetail

  Exploitation involves high complexity because the attacker must time the injected payload to survive any sanitization pass and rely on a clinician navigating to the affected print view, introducing environmental dependencies.

Blast Radius

• Reads the clinician's active session tokens and CSRF tokens directly from the browser session.
• Performs authenticated actions inside OpenEMR as the clinician, including accessing or modifying patient health records.
• Crosses the patient-to-clinician trust boundary, allowing a low-privilege portal user to operate at clinician privilege level.