Stored Cross-Site Scripting in OpenEMR by OpenEMR

CVE-2026-124448

What is CVE-2026-124448?

OpenEMR prior to version 8.3.0 is vulnerable to a stored cross-site scripting issue due to improper handling of attributes in CCDA/CCD preview XSL stylesheets. The vulnerability allows authenticated users to upload specially crafted CCDA/CCD documents containing event-handler attributes. When these documents are previewed, malicious scripts can be executed in the context of a clinician's session, compromising the integrity and confidentiality of sensitive data. Security patches are available, and users are encouraged to update to the latest version to mitigate risks.

References