CVE-2026-124448 · Other
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.3.0 fails to strip event-handler attributes from CCDA/CCD preview stylesheets, so a crafted uploaded document can carry script. When a clinician previews that document, the script runs in their session and can act as them inside the record system.
first public Aug 18, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Clinics and hospitals running OpenEMR before 8.3.0 that let users upload CCDA/CCD clinical documents. The risk requires a logged-in user to upload a crafted document and a clinician to preview it, so installations that do not accept or preview these documents are less exposed.
Not affected if no-ccda-upload, openemr-8.3.0-or-later
Who cares healthcare, openemr, self-hosted
8.3.0.8.3.0 or later.OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in the CCDA/CCD preview stylesheets, where cda.xsl copies event-handler attributes whose values evade a character denylist and ccd.xsl copies table-cell attributes unsanitized into preview HTML. Authenticated users can upload a crafted CCDA/CCD document with onmouseover, onclick, or onfocus handlers to execute script in a clinician's session when previewed.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.