{"id":"CVE-2026-103935","kind":"vulnerability","aliases":["CVE-2026-103935"],"related":[],"title":"OpenEMR: stored XSS in transfer and cognitive forms exposes patient records","description":"OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/forms/transfer_summary/new.php and interface/forms/functional_cognitive_status/new.php render stored transfer_to, code, and codetext values with text(), which uses ENT_NOQUOTES, inside double-quoted HTML value attributes. An authenticated clinical user can store a value containing a double quote that escapes the attribute and injects event-handler markup when another clinician opens the form. Successful exploitation can expose session data and protected health information or permit patient-record actions in the victim's session. This issue is fixed in version 8.3.0.","summary":"OpenEMR, an electronic health records application, fails to escape stored form values in two clinical forms, so a crafted value breaks out of an HTML attribute. When another clinician opens the form, injected script can read their session and protected health information or act on patient records in their session.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","package","php","self-hosted"],"not_affected_if":["forms-unused","version-8.3.0-or-later"],"how_to_check":"- Check the OpenEMR version in the running installation; affected versions are those before `8.3.0`.\n- Look for `interface/forms/transfer_summary/new.php` and `interface/forms/functional_cognitive_status/new.php` in the deployed code and confirm whether they match the vulnerable release.","fix":"- Move OpenEMR to `8.3.0` or later.","status":"open","published_at":"2026-11-05T20:17:38+00:00","first_seen_at":"2026-11-05T20:40:43+00:00","triaged_at":"2026-11-05T20:42:59+00:00","updated_at":"2026-11-05T20:42:59+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-05T20:42:59Z","model":"claude-haiku-5-5","output":{"fix":"- Move OpenEMR to `8.3.0` or later.","reach":"network","title":"OpenEMR: stored XSS in transfer and cognitive forms exposes patient records","impact":"high","summary":"OpenEMR, an electronic health records application, fails to escape stored form values in two clinical forms, so a crafted value breaks out of an HTML attribute. When another clinician opens the form, injected script can read their session and protected health information or act on patient records in their session.","audience":"businesses","category":"package","nicknames":[],"who_cares":["openemr","self-hosted","healthcare","php"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker script runs in clinician sessions, exposing data and patient records","analyst_note":"","how_to_check":"- Check the OpenEMR version in the running installation; affected versions are those before `8.3.0`.\n- Look for `interface/forms/transfer_summary/new.php` and `interface/forms/functional_cognitive_status/new.php` in the deployed code and confirm whether they match the vulnerable release.","plain_action":"","needs_analyst":false,"not_affected_if":["version-8.3.0-or-later","forms-unused"],"who_is_affected":"Clinics and organizations that run OpenEMR themselves on versions before 8.3.0 and let staff with clinical accounts use the transfer summary or functional and cognitive status forms. The attacker needs an authenticated clinical user account, and the payload fires when another clinician opens the stored record. Hosts that do not use these forms or are already on 8.3.0 or later are not exposed.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000735,"input_tokens":4370,"output_tokens":595,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-103935':14A,17A '-2026':13A,16A '8.3.0':92C,172C 'act':68B 'action':160C 'anoth':52B,140C 'applic':30B,89C 'attribut':50B,116C,132C 'authent':118C 'break':45B 'clinic':39B,119C 'clinician':53B,141C 'code':100C 'codetext':102C 'cognit':7A 'contain':125C 'craft':43B 'cve':12A,15A 'data':150C 'doubl':112C,127C 'double-quot':111C 'electron':27B,82C 'ent':108C 'escap':33B,130C 'event':136C 'event-handl':135C 'exploit':146C 'expos':9A,148C 'fail':31B 'fix':169C 'form':8A,35B,40B,56B,144C 'free':78C 'handler':137C 'health':28B,65B,83C,153C 'healthcar':18B 'host':24B 'html':49B,114C 'inform':66B,154C 'inject':57B,134C 'insid':110C 'interface/forms/functional_cognitive_status/new.php':95C 'interface/forms/transfer_summary/new.php':93C 'issu':167C 'manag':88C 'markup':138C 'medic':86C 'noquot':109C 'open':54B,80C,142C 'openemr':1A,19B,25B,75C 'packag':20B 'patient':10A,70B,158C 'patient-record':157C 'permit':156C 'php':21B 'practic':87C 'prior':90C 'protect':64B,152C 'quot':113C,128C 'read':60B 'record':11A,29B,71B,84C,159C 'render':96C 'script':58B 'self':23B 'self-host':22B 'session':62B,74B,149C,165C 'sourc':81C 'store':2A,34B,97C,122C 'success':145C 'text':105C 'transfer':5A,98C 'two':38B 'use':107C 'user':120C 'valu':36B,44B,103C,115C,124C 'version':171C 'victim':163C 'xss':3A","nicknames":[],"mitigations":[],"who_affected":"Clinics and organizations that run OpenEMR themselves on versions before 8.3.0 and let staff with clinical accounts use the transfer summary or functional and cognitive status forms. The attacker needs an authenticated clinical user account, and the payload fires when another clinician opens the stored record. Hosts that do not use these forms or are already on 8.3.0 or later are not exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","high","openemr","package","php","selfhosted"],"campaign_type":null,"first_public_at":"2026-08-18T08:42:48+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103935","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103935","severity":null,"published_at":"2026-11-05T20:17:38+00:00","modified_at":"2026-11-05T20:17:38+00:00","first_seen_at":"2026-11-05T20:40:43+00:00","fetched_at":"2026-11-05T20:40:43+00:00","note":null}],"documents":[{"id":79804,"url":"https://github.com/openemr/openemr/commit/d301444f6c4d9c4fa732ce57f3989214081c6108","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79793,"url":"https://github.com/openemr/openemr/releases/tag/v8_3_0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79806,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-pm2v-5p99-37p2","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-08-18T08:42:48+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}