The vulnerability is a reflected cross‑site scripting flaw in the custom template editor of OpenEMR. A crafted URL containing an unescaped contextName parameter can send arbitrary JavaScript to an authenticated staff member’s browser. This flaw enables the execution of client‑side code, allowing an attacker to hijack the user’s session, steal data, perform actions on behalf of the user, or modify content in the browser. The weakness is a classic reflected XSS, identified as CWE‑79.

OpenEMR, the open‑source electronic health records system, is affected. Vulnerable releases start with 7.0.2.1 and continue through versions up to but not including 8.0.0.3. The vulnerability was fixed in release 8.0.0.3, which should be applied by all users running earlier versions.

The CVSS score of 6.1 indicates a moderate severity flaw, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The attack vector involves an attacker sending a malicious URL to an authenticated staff member; no OpenEMR account is required to craft the exploit. Because the flaw only affects the client’s browser and does not allow server‑side code execution or privilege escalation, the risk is contained to the compromised user. The absence of a listing in CISA’s KEV catalog further indicates no known exploitations have been reported. Nonetheless, organizations should treat this as a medium‑to‑high risk due to the potential impact on patient data confidentiality and staff productivity.