OpenEMR Files

Changelog: OpenEMR 8.0.0.2 → 8.0.0.3

Release date: 2026-03-25

Security Fixes

• [High] Authenticated Blind Boolean-Based SQL Injection in new_search_popup.php (github.com)
• [High] Missing Authorization in Procedure Order AJAX Deletion Handler
• [High] Stored XSS in patient encounter Eye Exam form $CHRONIC2 and $CHRONIC3
• [High] Missing Authorization on Claim File Download Endpoint
• [High] Stored XSS in CCDA Preview via Unsanitized linkHtml Attributes
• [High] IDOR in Patient Notes Web UI allows unauthorized note access/modification
• [High] XInclude Injection in CCDA Import Allows Reading Arbitrary Server Files
• [High] SQL Injection in CAMOS Form
• [High] SQL Injection in PostCalendar Category Delete
• [Medium] Improper ACL On Import/Export Popup
• [Medium] SQL Injection via Unsanitized Variables in MedEx Recall/Reminder Processing
• [Medium] Reflected XSS via Unescaped contextName Parameter in Custom Template Editor
• [Medium] Reflected XSS in ajax_download.php via reportID parameter (github.com)
• [Medium] IDOR in Portal Payment Page Allows Cross-Patient Record Access
• [Medium] IDOR in Fee Sheet Product Save
• [Medium] Missing Authorization in show-signature.php Allows Portal Patients to Read Staff Signatures (github.com)
• [Medium] Missing ACL Checks on Insurance Company API Routes
• [Medium] Reflected XSS in graphs.php via title parameter (github.com)
• Missing ACL check on eRx log viewer
• Parameterize all SQL in deleter.php
• Add CSRF protection and parameterize SQL in new_payment.php
• Parameterize SQL, add CSRF, fix serialization injection in portal appointment
• Parameterize SQL in pnotes.inc.php
• Prevent open redirect in portal messaging (#11223)

Bug Fixes

• Include custom LBF layout forms in patient report (#11146)
• Hide dispensed medications section when inhouse_pharmacy is disabled (#11144)
• Correct assignment typo in AuthHash SHA512 fallback (#11019)
• Align allergy begdate validation with YYYY-MM-DD docs (#10993)
• Enforce newest-first sort in encounters report (#10991)
• Correct "Dislay" typo in main menu logo description (#10988)
• Avoid HTML-encoded status text in demographics widgets (#10985)
• Accept #RRGGBB in status color field (#10984)
• Add missing site parameter to SDOH assessment URLs (#10949)
• Qualify column reference in CareTeamService::getCareTeamData() (#10899)
• Add state license number to eye prescription popup (#10894)
• Create certificates directory before writing key files (#10888)
• Dispense glasses Rx: manifest/dispensed refraction (#10882)
• Use theme-stable colors for receipt background contrast (#10851)

Changed

• Add missing GHSA and fix advisory URLs in 8.0.0.2 changelog (#11180)