CVE-2026-124448
Received Received - Intake

Stored XSS in OpenEMR Preview Stylesheets

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in the CCDA/CCD preview stylesheets, where cda.xsl copies event-handler attributes whose values evade a character denylist and ccd.xsl copies table-cell attributes unsanitized into preview HTML. Authenticated users can upload a crafted CCDA/CCD document with onmouseover, onclick, or onfocus handlers to execute script in a clinician's session when previewed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-124448
EUVD
EUVD-2026-119552

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openemr openemr to 8.3.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenEMR before version 8.3.0 has a stored cross-site scripting (XSS) vulnerability in the CCDA/CCD preview stylesheets. The cda.xsl and ccd.xsl files copy event-handler attributes like onmouseover, onclick, or onfocus into preview HTML without proper sanitization. Authenticated users can upload a crafted document to execute malicious scripts when a clinician previews it.

Detection Guidance

To detect this vulnerability, inspect OpenEMR versions before 8.3.0 for unauthorized CCDA/CCD documents with event-handler attributes like onmouseover, onclick, or onfocus. Check XSLT files cda.xsl and ccd.xsl for improper sanitization of attributes. Review server logs for unusual document uploads or preview activities.

Impact Analysis

An attacker could steal session cookies, manipulate displayed content, or perform actions on behalf of the clinician. This could lead to unauthorized data access, data theft, or further compromise of the OpenEMR system and patient records.

Compliance Impact

This vulnerability could lead to unauthorized access to protected health information (PHI), violating HIPAA. It may also result in data breaches affecting GDPR compliance due to unauthorized data exposure or manipulation.

Mitigation Strategies

Upgrade OpenEMR to version 8.3.0 or later. Apply allowlisting for safe attributes in XSLT transformations. Use HTMLPurifier to sanitize XSLT output. Implement Content Security Policy (CSP) headers to restrict script execution. Monitor for and remove any malicious CCDA/CCD documents.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-124448. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...