Act nowDisclosed

Advisory · CVE-2026-124463

OpenEMR CAMOS notes can plant scripts that run when prescriptions print

OpenEMR before 8.3.0 contains stored cross-site scripting that lets authenticated users with CAMOS access inject HTML by saving malicious CAMOS content through ajax_save.php, storing a script payload that executes unencoded when the entry is printed via the non-print_html branch of rx_print.php, performing actions and reading data as the victim user, rated critical at CVSS 9.3 under version 4.0; fixed in 8.3.0.

Advisory published November 8, 2026Independent summary
Vendor
OpenEMR
Product
OpenEMR
Identifier / CWE
CVE-2026-124463
CWE-79
Action timing
Immediate
ELI5

Explain it like I’m five

OpenEMR's CAMOS notes let clinicians save free-text entries, and the print page shows them without cleaning them up. A user with CAMOS access can save a note containing a script, and it runs in the victim's browser when someone prints the prescription.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Malicious CAMOS saved

    An authenticated user with CAMOS access saves crafted content through ajax_save.php.

  2. 02Payload stored

    The script is stored unencoded in the CAMOS entry.

  3. 03Prescription printed

    A victim prints the entry through the non-print_html branch of rx_print.php.

  4. 04Script executes

    The payload runs as the victim user, performing actions and reading data.

What happened

OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability that allows authenticated users with CAMOS access to inject HTML by saving malicious CAMOS content through ajax_save.php. Attackers can store a script payload that executes unencoded when the entry is printed via the non-print_html branch of rx_print.php, performing actions and reading data as the victim user. The record rates it critical at CVSS 9.3 under version 4.0, with network attack vector, low complexity, low privileges required, and passive user interaction.

Printing a prescription is routine clinical work, and this flaw turns it into a script execution path. The flaw is fixed in OpenEMR 8.3.0.

What to do

  1. Inventory OpenEMR deployments and record each version.
  2. Upgrade to OpenEMR 8.3.0 or later.
  3. Review CAMOS entries for injected HTML or script content.
  4. Review clinician sessions for actions taken after printing CAMOS entries.
  5. Verify the deployed version after updating.

Management note

A stored script in a clinical note fires during ordinary work, not during an attack. Check what was saved, not just what version is running.