---
id: CVE-2026-124448
title: OpenEMR before 8.3.0 Stored XSS via CCDA/CCD Preview XSLT Attributes
summary: >-
  OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in
  the CCDA/CCD preview stylesheets, where cda.xsl copies event-handler
  attributes whose values evade a character denylist and ccd.xsl copies
  table-cell attributes…
severity: high
cvss: 7.6
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L'
cvssSource: cna
cwe:
  - CWE-79
vendor: openemr
product: openemr
affected:
  - openemr < 8.3.0
published: '2026-11-08'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T13:15:40.313Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-124448'
references:
  - url: 'https://github.com/openemr/openemr/security/advisories/GHSA-rghp-vwvf-c2r9'
    label: GitHub Security Advisory (GHSA-rghp-vwvf-c2r9)
  - url: >-
      https://www.vulncheck.com/advisories/openemr-before-8.3.0-stored-xss-via-ccda-ccd-preview-xslt-attributes
    label: >-
      VulnCheck Advisory: OpenEMR before 8.3.0 Stored XSS via CCDA/CCD Preview
      XSLT Attributes
tags:
  - cve.org
ingestedAt: '2026-11-08T13:50:34.975Z'
---

## Overview

OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in the CCDA/CCD preview stylesheets, where cda.xsl copies event-handler attributes whose values evade a character denylist and ccd.xsl copies table-cell attributes unsanitized into preview HTML. Authenticated users can upload a crafted CCDA/CCD document with onmouseover, onclick, or onfocus handlers to execute script in a clinician's session when previewed.

## Affected

- `openemr < 8.3.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.