CVE-2026-32118 is a stored cross-site scripting flaw in OpenEMR, the open source electronic health records system, scored 5.4. A clinician can save script in a pain map annotation that runs for everyone who opens the form. Upgrade OpenEMR to 8.0.0.1 or later.
What's affected
OpenEMR before 8.0.0.1. The patched version is 8.0.0.1.
The advisory says any authenticated clinician can plant the script, which then runs in the browser of every later viewer of that encounter form. Session cookies were not marked HttpOnly, which lets script read them and hijack sessions, including admin sessions.
How to check if you're exposed
Check your OpenEMR version in the application's about or admin pages, or in your Composer lock file.
composer show openemr/openemr
Then review stored clickmap annotations for unexpected HTML. Because the data lives in encounter records, ask your database administrator to help look at the stored form content rather than viewing it in the browser.
What to do now
- Upgrade OpenEMR to 8.0.0.1 or later.
- Mark session cookies as HttpOnly in your PHP and web server configuration if your version does not already.
- Review who holds clinician accounts and remove ones you do not need.
- Ask admins to log out and in again after the patch, to end sessions that may have been exposed.
Why it matters
The class is CWE-79, cross-site scripting. The page took the annotation text, decoded it and joined it into an HTML string handed to jQuery, which creates live elements, event handlers included. Stored XSS is worse than the reflected kind because the payload waits in the database and runs for each viewer.
In a health record system, a stolen admin session is a privacy problem as well as a security one. The score is moderate because it needs a logged in clinician, but accounts inside a practice can be many and widely shared.
The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and no advisory I read says it is exploited in the wild. Treat it as a patch to schedule promptly, not a fire drill, unless your own logs say otherwise.
Quick check
Do I need a malicious clinician for this?
The advisory says an authenticated clinician is needed to plant the script. A stolen or shared clinician login would also do.
Does HttpOnly fix it?
It reduces cookie theft but does not stop the script from running. Upgrade.
Sources
Last reviewed: 19 October 2026.
