OpenEMR through version 8.2.0 contains a stored XSS vulnerability in its patient portal template system. Authenticated administrators can inject arbitrary HTML and JavaScript payloads because the template save mode only filters literal PHP open tags and lacks proper output encoding at the template retrieval endpoint. Additionally, the absence of HttpOnly attributes on cookies enables attackers to access session tokens via document.cookie. This combination allows full session hijacking of any user (admin, clinician, or patient) who views the maliciously crafted template. The vulnerability is tracked as CVE-2026-67612 with a CVSS 3.1 base score of 4.8 (medium severity). No patch or remediation information is currently provided.

The vulnerability enables authenticated administrators to inject stored malicious scripts that execute in the context of other users viewing the patient portal templates. This can lead to exfiltration of session tokens and full session hijacking of administrators, clinicians, or patients. The impact includes loss of confidentiality and integrity of user sessions but does not affect availability. The attack requires authenticated access with high privileges and user interaction (viewing the poisoned template).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative access to trusted users only and monitor for suspicious template modifications. Consider applying manual output encoding or sanitization if feasible. Review cookie settings to enforce HttpOnly attributes to reduce session token exposure.