CVE-2026-33346: XSS in OpenEMR Patient Portal

The impact of this XSS vulnerability is significant, as it allows attackers to execute arbitrary JavaScript code within the context of a staff user's session. This could enable attackers to steal sensitive patient data, including Protected Health Information (PHI), manipulate payment records, or even gain unauthorized access to the OpenEMR system. The stored nature of the vulnerability means the malicious payload persists, potentially affecting multiple staff members over time. Successful exploitation could lead to regulatory fines (HIPAA), reputational damage, and disruption of healthcare services. While no direct precedent exists for this specific OpenEMR vulnerability, XSS vulnerabilities in healthcare applications are a known attack vector, and the potential for data exfiltration and system compromise is high.

1. Reserved2026-03-18
2. Published2026-03-19
3. Modified2026-03-20
4. EPSS updated2026-03-27

The primary mitigation for CVE-2026-33346 is to immediately upgrade OpenEMR to version 8.0.0.2 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds such as strict input validation and output encoding on the portal/lib/paylib.php and portal/portal_payment.php files. Web application firewalls (WAFs) configured to detect and block XSS payloads targeting these specific files can also provide a layer of protection. Regularly review OpenEMR logs for suspicious activity, particularly related to patient portal payments, and implement a robust security monitoring system. After upgrading, confirm the fix by attempting to submit a payment with a known malicious JavaScript payload and verifying that it is properly sanitized and does not execute.