CVE-2026-32121·PHP vulnerability
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, Stored XSS in prescription CSS/HTML print view via patient demographics. That finding involves server-side rendering of patient names via raw PHP echo. This finding involves client-side DOM-based rendering via jQuery .html() in a completely different component (portal/sign/assets/signer_api.js). The two share the same root cause (unsanitized patient names in patient_data), but they have different sinks, different affected components, different trigger actions, and require independent fixes. This vulnerability is fixed in 8.0.0.1.
- Severity
- high
- Software
- PHP
- Fixed in
- 8.0.0.1
- Published
- 2026-03-11
Affected versions
Until: 8.0.0.1
Fixed in: 8.0.0.1
How to fix this CVE
OpenEMR users must upgrade to version 8.0.0.1 or later to patch a stored cross-site scripting (XSS) vulnerability in the patient portal's digital signature component. The vulnerability stems from improper sanitization of patient demographic data (names) when rendering in the signer API, allowing attackers with valid credentials to inject malicious scripts through patient records. Apply the patch immediately, especially if your deployment exposes the portal sign module to authenticated users.
sudo dnf update phpDefensia detects this vulnerability
What an exploitation attempt looks like
Sample log line indicative of exploitation attempts:
POST|GET /portal/sign/assets/signer_api.js.*patient_data.*(<script|javascript:|onerror|onclick|on\w+\s*=)WAF mitigation (if patching is not yet possible)
Add this rule to your WAF to block exploitation attempts while you schedule the patch.
Implement WAF rules to block requests to /portal/sign/assets/signer_api.js containing HTML/JavaScript entities in patient_data parameters. Use input validation to reject patient names containing script tags, event handlers, or encoded JavaScript. Apply output encoding for all patient demographic fields rendered in the DOM via jQuery.How to check if you are affected
- Check OpenEMR version: grep -r 'version' /path/to/openemr/version.php | head -1
- Verify the signer_api.js file exists and check its modification date: stat /path/to/openemr/portal/sign/assets/signer_api.js
- Search web server logs for requests to /portal/sign/assets/signer_api.js with suspicious parameters: grep 'signer_api.js' /var/log/apache2/access.log | grep -E '(script|onerror|onclick|<|%3C)'
- Confirm the patch was applied by verifying OpenEMR version shows 8.0.0.1 or higher: grep -r 'OPENEMR_VERSION' /path/to/openemr/version.php
FAQ
What is CVE-2026-32121?
CVE-2026-32121 is a stored XSS vulnerability in OpenEMR's patient portal signature component that allows authenticated attackers to inject malicious JavaScript through unsanitized patient name fields, which are rendered client-side via jQuery's .html() method without proper encoding.
Is CVE-2026-32121 being actively exploited?
No, this vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog and there are no public exploit proofs-of-concept available.
What versions of OpenEMR are affected by CVE-2026-32121?
All versions prior to 8.0.0.1 are affected; the vulnerability was remediated in OpenEMR 8.0.0.1 and later.
How do I check if my server is vulnerable to CVE-2026-32121?
Run 'grep -r "OPENEMR_VERSION" /path/to/openemr/version.php' and verify the version number is 8.0.0.1 or higher; versions below this are vulnerable.
Does Defensia detect CVE-2026-32121?
Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If OpenEMR is installed on a monitored server, CVE-2026-32121 will appear in your dashboard with remediation steps.
Related PHP CVEs
References
Track CVEs across your fleet automatically
Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-32121. Free for 1 server.
Get started free