Openemr CVE-2026-33932

Requires OpenEMR prior to version 8.0.0.3. Attacker must have authenticated access to upload or send a CCDA document. Victim clinician must preview the malicious CCDA document in their browser to trigger arbitrary JavaScript execution.

The CVSS score of 7.6 (High) reflects a network-based attack requiring low privileges and user interaction with changed scope, resulting in high confidentiality impact and low integrity impact. The attack vector is realistic in healthcare environments where CCDA documents are routinely exchanged between providers, health information exchanges, and patients. The low attack complexity (AC:L) indicates exploitation is straightforward once an attacker can upload or transmit a CCDA document. The changed scope (S:C) is particularly concerning as it allows escape from the security context of the vulnerable component. The requirement for low privileges (PR:L) and user interaction (UI:R) provides some mitigation, as attackers need authenticated access to upload documents and must wait for a clinician to preview them. Without EPSS or KEV data indicating active exploitation, and given the required preconditions, this represents a moderate real-world risk that should be prioritized for healthcare organizations using OpenEMR but is not an immediate emergency requiring out-of-cycle patching.

An attacker with low-privileged access to an OpenEMR instance (such as a patient portal account or compromised external provider credentials) crafts a malicious CCDA document containing linkHtml elements with javascript: protocol URLs or event handler attributes like onclick. The attacker uploads this document through the patient portal or sends it via a health information exchange integration. When a clinician with elevated privileges opens the document preview to review the patient's clinical information, the malicious JavaScript executes in their authenticated session, potentially allowing the attacker to steal session tokens, access sensitive patient data, modify clinical records, or perform actions with the clinician's privileges.