OpenEMR versions up to and including 8.2.0 implement a patient portal template system that sanitizes only literal PHP open tags but fails to encode output. During template creation, authenticated administrators can embed arbitrary HTML and JavaScript, because the system stores the payload without additional filtering. When a user accesses the affected template, the browser renders the malicious content, giving the attacker the ability to read the document.cookie store and hijack active sessions of any portal user, including administrators, clinicians, and patients.

The vulnerability affects the openemr product from the OpenEMR vendor; all instances running OpenEMR 8.2.0 or earlier are vulnerable. No later releases are mentioned as affected.

The CVSS base score of 4.8 classifies the flaw as moderate severity. The EPSS score is unavailable, and the vulnerability is not listed in the KEV catalog, indicating no publicly confirmed exploitation yet. Nevertheless, exploitation requires an authenticated administrator to inject the payload, but once injected the malicious template can be viewed by any portal user, resulting in persistent session hijacking across users, making the risk significant enough to warrant prompt remediation.