high CVSS 7.7

CVE-2026-32121·PHP vulnerability

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, Stored XSS in prescription CSS/HTML print view via patient demographics. That finding involves server-side rendering of patient names via raw PHP echo. This finding involves client-side DOM-based rendering via jQuery .html() in a completely different component (portal/sign/assets/signer_api.js). The two share the same root cause (unsanitized patient names in patient_data), but they have different sinks, different affected components, different trigger actions, and require independent fixes. This vulnerability is fixed in 8.0.0.1.

Severity
high
Software
PHP
Fixed in
8.0.0.1
Published
2026-03-11

Affected versions

Until: 8.0.0.1

Fixed in: 8.0.0.1

How to fix this CVE

OpenEMR users must upgrade to version 8.0.0.1 or later to patch a stored cross-site scripting (XSS) vulnerability in the patient portal's digital signature component. The vulnerability stems from improper sanitization of patient demographic data (names) when rendering in the signer API, allowing attackers with valid credentials to inject malicious scripts through patient records. Apply the patch immediately, especially if your deployment exposes the portal sign module to authenticated users.

sudo dnf update php

Defensia detects this vulnerability

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

POST|GET /portal/sign/assets/signer_api.js.*patient_data.*(<script|javascript:|onerror|onclick|on\w+\s*=)

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch.

Implement WAF rules to block requests to /portal/sign/assets/signer_api.js containing HTML/JavaScript entities in patient_data parameters. Use input validation to reject patient names containing script tags, event handlers, or encoded JavaScript. Apply output encoding for all patient demographic fields rendered in the DOM via jQuery.

How to check if you are affected

  1. Check OpenEMR version: grep -r 'version' /path/to/openemr/version.php | head -1
  2. Verify the signer_api.js file exists and check its modification date: stat /path/to/openemr/portal/sign/assets/signer_api.js
  3. Search web server logs for requests to /portal/sign/assets/signer_api.js with suspicious parameters: grep 'signer_api.js' /var/log/apache2/access.log | grep -E '(script|onerror|onclick|<|%3C)'
  4. Confirm the patch was applied by verifying OpenEMR version shows 8.0.0.1 or higher: grep -r 'OPENEMR_VERSION' /path/to/openemr/version.php

FAQ

What is CVE-2026-32121?

CVE-2026-32121 is a stored XSS vulnerability in OpenEMR's patient portal signature component that allows authenticated attackers to inject malicious JavaScript through unsanitized patient name fields, which are rendered client-side via jQuery's .html() method without proper encoding.

Is CVE-2026-32121 being actively exploited?

No, this vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog and there are no public exploit proofs-of-concept available.

What versions of OpenEMR are affected by CVE-2026-32121?

All versions prior to 8.0.0.1 are affected; the vulnerability was remediated in OpenEMR 8.0.0.1 and later.

How do I check if my server is vulnerable to CVE-2026-32121?

Run 'grep -r "OPENEMR_VERSION" /path/to/openemr/version.php' and verify the version number is 8.0.0.1 or higher; versions below this are vulnerable.

Does Defensia detect CVE-2026-32121?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If OpenEMR is installed on a monitored server, CVE-2026-32121 will appear in your dashboard with remediation steps.

Related PHP CVEs

CVE-2026-28289CVSS 10FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. A patch bypass vulnerability for CVE-2026-27636 in FreeScout 1.8.206 and earlier allows any authenticated user with file upload permissions to achieve Remote Code Execution (RCE) on the server by uploading a malicious .htaccess file using a zero-width space character prefix to bypass the security check. The vulnerability exists in the sanitizeUploadedFileName() function in app/Http/Helper.php. The function contains a Time-of-Check to Time-of-Use (TOCTOU) flaw where the dot-prefix check occurs before sanitization removes invisible characters. This vulnerability is fixed in 1.8.207.
CVE-2026-39337CVSS 10ChurchCRM is an open-source church management system. Prior to 7.1.0, critical pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard allows unauthenticated attackers to inject arbitrary PHP code during the initial installation process, leading to complete server compromise. The "$dbPassword" variable is not sanitized. This vulnerability exists due to an incomplete fix for CVE-2025-62521. This vulnerability is fixed in 7.1.0.
CVE-2025-25174CVSS 10Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in beeteam368 BeeTeam368 Extensions beeteam368-extensions allows PHP Local File Inclusion.This issue affects BeeTeam368 Extensions: from n/a through <= 1.9.4.
CVE-2025-62521CVSS 10ChurchCRM is an open-source church management system. Prior to version 5.21.0, a pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard allows unauthenticated attackers to inject arbitrary PHP code during the initial installation process, leading to complete server compromise. The vulnerability exists in `setup/routes/setup.php` where user input from the setup form is directly concatenated into a PHP configuration template without any validation or sanitization. Any parameter in the setup form can be used to inject PHP code that gets written to `Include/Config.php`, which is then executed on every page load. This is more severe than typical authenticated RCE vulnerabilities because it requires no credentials and affects the installation process that administrators must complete. Version 5.21.0 patches the issue.
CVE-2024-5932CVSS 10The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 via deserialization of untrusted input from the 'give_title' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code remotely, and to delete arbitrary files.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-32121. Free for 1 server.

Get started free