OpenEMR: Stored cross-site scripting in CCDA/CCD preview (CVE-2026-124448)

OpenEMR versions prior to 8.3.0 contain stored cross-site scripting (XSS) vulnerabilities within the CCDA/CCD preview stylesheets. Specifically, the cda.xsl and ccd.xsl files fail to properly sanitize input, allowing event-handler attributes such as onmouseover, onclick, and onfocus to be injected into previewed HTML. An authenticated attacker can upload a crafted CCDA/CCD document containing these malicious handlers to execute unauthorized JavaScript in the context of a clinician's session.

Impact

Successful exploitation allows authenticated attackers to execute arbitrary JavaScript within a clinician's session, potentially leading to unauthorized data access, session hijacking, or other actions performed with the clinician's privileges within the OpenEMR application.

Recommendation

• Upgrade OpenEMR to version 8.3.0 or later to apply the fix for CVE-2026-124448.
• Implement Content Security Policy (CSP) headers that restrict inline script execution to reduce the impact of XSS vulnerabilities.
• Audit access logs for user accounts uploading CCDA/CCD documents to identify potential abuse of the file upload functionality.