CVE-2026-55081
Deferred Deferred - Pending Action

XSS in DHIS2 OpenAPI HTML Endpoint

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: GitHub, Inc.

Description
DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. The DHIS2 OpenAPI HTML endpoint reflected values from the `scope` query parameter into the generated HTML document without sufficient sanitization. A crafted `scope` value could be rendered as active HTML or JavaScript in the OpenAPI documentation page. An attacker able to get a user to open a crafted OpenAPI HTML URL could execute JavaScript in that user's browser in the DHIS2 origin. Affected versions: DHIS2 2.42 and 2.43 before the 2026-06-09 security patch releases, and the development branch for DHIS2 2.44 before the fix was merged. Patched in 2.42.5.1, 2.43.0.1, the 2.42 and 2.43 line branches, and the 2.44 development branch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-21
Last Modified
2026-07-21
Generated
2026-07-22
AI Q&A
2026-07-21
EPSS Evaluated
N/A
NVD
CVE-2026-55081
EUVD
EUVD-2026-46362

Affected Vendors & Products

Showing 8 associated CPEs
Vendor Product Version / Range
dhis2 dhis2 to 2.42.5.1 (exc)
dhis2 dhis2 to 2.43.0.1 (exc)
dhis2 dhis2 2.44
dhis2 dhis2 2.42
dhis2 dhis2 2.43
dhis2 dhis2 to 2026-06-09 (exc)
dhis2 dhis2 2.42.5.1
dhis2 dhis2 2.43.0.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-55081 is a reflected Cross-Site Scripting (XSS) vulnerability in DHIS2's OpenAPI HTML endpoint. The scope query parameter was reflected into the generated HTML without proper sanitization, allowing malicious JavaScript or HTML injection via a crafted URL. When a user opens the malicious URL, the injected code executes in their browser within the DHIS2 domain.

Detection Guidance

Check DHIS2 version with: curl -s http://your-dhis2-server/dhis-web-commons/security/login.action | grep -i version. Affected versions are 2.42.x before 2.42.5.1, 2.43.0 before 2.43.0.1, and 2.44 development branch before June 9 2026.

Impact Analysis

An attacker could trick a user into opening a specially crafted URL, leading to unauthorized actions or data theft. The attacker could execute JavaScript in the user's browser within the DHIS2 origin, potentially stealing session cookies, modifying data, or performing actions on behalf of the user.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating confidentiality and integrity requirements in GDPR and HIPAA. It may result in data breaches, non-compliance with data protection obligations, and potential legal penalties for organizations using vulnerable DHIS2 versions.

Mitigation Strategies

Upgrade DHIS2 to patched versions 2.42.5.1, 2.43.0.1, or 2.44 development branch. If upgrading is not possible, apply the security patches from PRs 24158, 24159, 24160, 24161, or 24162 to your current version.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55081. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart