Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV N L L R C H H N 8.7 .0021 11.2 —
AFFECTED Product Versions Fixed openemr < 8.0.0.1 – —
TIMELINE May 14 Reserved by GitHub_M Jun 9 EXPLOIT PUBLISHED — CVE-2026-46518 (openemr). Public exploit reference added. Jun 9 Published (CNA: GitHub_M)
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.1, a stored cross-site scripting vulnerability in the prescription CSS/HTML multi-print feature allows a patient portal user to execute arbitrary JavaScript in a clinician's browser session. Patient demographic fields (name, address) are rendered without output encoding in multiprintcss_header(), and portal patients can write attacker-controlled HTML directly into patient_data by calling the PUT api/patient/:num endpoint, which bypasses the intended audit review workflow. Because the XSS fires in the clinician's authenticated session on the main OpenEMR interface, the attacker can access CSRF tokens, session data, and perform actions as the clinician — crossing the patient-to-clinician trust boundary. This issue has been patched in version 8.0.0.1.
| Date | Event | Detail |
|---|---|---|
| May 14, 2026 | Reserved | Reserved by GitHub_M |
| June 9, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-46518 (openemr). Public exploit reference added. |
| June 9, 2026 | Published | Published (CNA: GitHub_M) |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| openemr | openemr | — | < 8.0.0.1 | — |
Authoritative record: CVE-2026-46518 at cve.org
Vendors: openemr
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-46518 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.