---
id: "CVE-2026-103935"
kind: "vulnerability"
aliases: ["CVE-2026-103935"]
title: "OpenEMR: stored XSS in transfer and cognitive forms exposes patient records"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["healthcare", "openemr", "package", "php", "self-hosted"]
not_affected_if: ["forms-unused", "version-8.3.0-or-later"]
published_at: "2026-11-05T20:17:38+00:00"
first_seen_at: "2026-11-05T20:40:43+00:00"
updated_at: "2026-11-05T20:42:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103935", "first_seen_at": "2026-11-05T20:40:43+00:00"}]
exploit_sources: []
---

# OpenEMR: stored XSS in transfer and cognitive forms exposes patient records

OpenEMR, an electronic health records application, fails to escape stored form values in two clinical forms, so a crafted value breaks out of an HTML attribute. When another clinician opens the form, injected script can read their session and protected health information or act on patient records in their session.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the OpenEMR version in the running installation; affected versions are those before `8.3.0`.
- Look for `interface/forms/transfer_summary/new.php` and `interface/forms/functional_cognitive_status/new.php` in the deployed code and confirm whether they match the vulnerable release.

## Fix

- Move OpenEMR to `8.3.0` or later.

## Timeline

- 2026-11-05T20:40:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-103935

## Documents

- [advisory] Vendor advisory: github.com https://github.com/openemr/openemr/security/advisories/GHSA-pm2v-5p99-37p2
- [fix] Patch: github.com https://github.com/openemr/openemr/commit/d301444f6c4d9c4fa732ce57f3989214081c6108
- [fix] Release notes: github.com https://github.com/openemr/openemr/releases/tag/v8_3_0

## From the sources

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/forms/transfer_summary/new.php and interface/forms/functional_cognitive_status/new.php render stored transfer_to, code, and codetext values with text(), which uses ENT_NOQUOTES, inside double-quoted HTML value attributes. An authenticated clinical user can store a value containing a double quote that escapes the attribute and injects event-handler markup when another clinician opens the form. Successful exploitation can expose session data and protected health information or permit patient-record actions in the victim's session. This issue is fixed in version 8.3.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_