Prior to OpenEMR version 8.0.0.1, any authenticated clinician can insert arbitrary JavaScript into the annotation text of the Graphical Pain Map legend. When other users view the encounter form, the injected script executes in their browsers. Because the session cookies are not marked HttpOnly, an attacker can hijack the session of any subsequent viewer, including administrative users. This enables a breach of confidentiality, integrity, and availability through credential theft and unauthorized actions within the application.

The vulnerability affects OpenEMR releases before 8.0.0.1. All installations of the openemr:openemr product that have not applied the 8.0.0.1 fix are susceptible.

The CVSS score of 5.4 indicates a medium severity. The EPSS score of less than 1% suggests that, so far, exploitation is unlikely to be widespread. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an authenticated clinician account with access to the Graphical Pain Map, but once a credential is used, the impact can be immediate and broad across all users who view the affected encounter.