CVE-2026-103935 · Package
NO FIX YET · SEE WHAT TO DO
OpenEMR, an electronic health records application, fails to escape stored form values in two clinical forms, so a crafted value breaks out of an HTML attribute. When another clinician opens the form, injected script can read their session and protected health information or act on patient records in their session.
first public Aug 18, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Clinics and organizations that run OpenEMR themselves on versions before 8.3.0 and let staff with clinical accounts use the transfer summary or functional and cognitive status forms. The attacker needs an authenticated clinical user account, and the payload fires when another clinician opens the stored record. Hosts that do not use these forms or are already on 8.3.0 or later are not exposed.
Not affected if forms-unused, version-8.3.0-or-later
Who cares healthcare, openemr, php, self-hosted
8.3.0.interface/forms/transfer_summary/new.php and interface/forms/functional_cognitive_status/new.php in the deployed code and confirm whether they match the vulnerable release.8.3.0 or later.OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/forms/transfer_summary/new.php and interface/forms/functional_cognitive_status/new.php render stored transfer_to, code, and codetext values with text(), which uses ENT_NOQUOTES, inside double-quoted HTML value attributes. An authenticated clinical user can store a value containing a double quote that escapes the attribute and injects event-handler markup when another clinician opens the form. Successful exploitation can expose session data and protected health information or permit patient-record actions in the victim's session. This issue is fixed in version 8.3.0.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.