Openemr
CVE-2026-33932
HIGH
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
Lifecycle Timeline
2DescriptionGitHub Advisory
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, a stored cross-site scripting vulnerability in the CCDA document preview allows an attacker who can upload or send a CCDA document to execute arbitrary JavaScript in a clinician's browser session when the document is previewed. The XSL stylesheet sanitizes attributes for all other narrative elements but not for linkHtml, allowing href="javascript:..." and event handler attributes to pass through unchanged. Version 8.0.0.3 patches the issue.
AnalysisAI
A stored cross-site scripting (XSS) vulnerability exists in OpenEMR's CCDA document preview functionality that allows authenticated attackers to execute arbitrary JavaScript in clinician browser sessions. OpenEMR versions prior to 8.0.0.3 are affected. The vulnerability occurs because the XSL stylesheet fails to sanitize linkHtml attributes in CCDA documents, allowing javascript: URLs and event handlers to execute when documents are previewed.
Technical ContextAI
OpenEMR is an open-source electronic health records (EHR) and medical practice management system. This vulnerability stems from insufficient input sanitization (CWE-79) in the XSLT transformation process used to render CCDA (Consolidated Clinical Document Architecture) documents for preview. CCDA is an HL7 standard XML format for exchanging clinical documents. The XSL stylesheet responsible for transforming CCDA XML into HTML properly sanitizes most narrative elements but contains a specific gap for linkHtml elements, allowing href attributes with javascript: protocol handlers and inline event handlers (onclick, onload, etc.) to pass through unescaped. When a clinician previews a malicious CCDA document, the unsanitized content executes in their authenticated browser context.
RemediationAI
Upgrade OpenEMR to version 8.0.0.3 or later, which contains the patch that properly sanitizes linkHtml attributes in CCDA documents. The fix is available in the release at https://github.com/openemr/openemr/releases/tag/v8_0_0_3 and the specific commit addressing the vulnerability can be reviewed at https://github.com/openemr/openemr/commit/95e6078889b5399b12b59117f998560cd94bd47d. Until patching is completed, organizations should implement compensating controls such as restricting CCDA document upload permissions to highly trusted users only, implementing content security policy (CSP) headers to limit inline script execution, and conducting security awareness training for clinical staff to avoid previewing CCDA documents from untrusted sources. Review audit logs for any suspicious CCDA document uploads or preview activity prior to patching.
An authenticated SQL injection vulnerability exists in OpenEMR ≤ 4.1.1 Patch 14 that allows a low-privileged attacker to
Unauthenticated token disclosure in OpenEMR before 8.0.0. CVSS 10.0. PoC and patch available.
Path traversal in OpenEMR 7.0.4 disposeDocument() allows file access. PoC available.
Path traversal in OpenEMR electronic health records before fix allows authenticated users to read arbitrary files on the
SQL injection in OpenEMR electronic health records before fix. Authenticated users can execute arbitrary SQL through the
OpenEMR 7.0.2 is vulnerable to SQL Injection via \openemr\library\classes\Pharmacy.class.php, \controllers\C_Pharmacy.cl
An issue in OpenEMR 7.0.2 allows a remote attacker to escalate privileges viaa crafted POST request using the noteid par
Information disclosure in OpenEMR 5.0.2 to before 8.0.0 exposes sensitive data. PoC and patch available.
interface/fax/fax_dispatch.php in OpenEMR 4.1.0 allows remote authenticated users to execute arbitrary commands via shel
interface/globals.php in OpenEMR 2.x, 3.x, and 4.x before 4.2.0 patch 2 allows remote attackers to bypass authentication
Authentication bypass vulnerability in portal/account/register.php in versions of OpenEMR before 5.0.1.4 allows a remote
OpenEMR 5.0.0 and prior allows low-privilege users to upload files of dangerous types which can result in arbitrary code
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today