OpenEMR versions before 8.3.0 contain a stored cross‑site scripting flaw in the CCDA/CCD preview feature. The application copies event‑handler attributes from uploaded CCDA/CCD documents into the preview HTML without proper filtering, allowing a crafted onmouseover, onclick, or onfocus handler to run in the browser of any user who opens the preview. An attacker who can authenticate to the system can upload a malicious document and trigger the script when another authenticated clinician views the preview, compromising confidentiality and integrity of the session.

All installations of OpenEMR running a version earlier than 8.3.0 are vulnerable. The problem resides in the CCDA/CCD preview stylesheets cda.xsl and ccd.xsl, which are used by all hospitals or clinics that store CCDA/CCD documents within the system.

The vulnerability carries a CVSS score of 8.6, indicating high severity. EPSS data is not available, so the current exploitation probability cannot be quantified. The flaw is not listed in the CISA KEV catalog. Because the attacker must have authenticated access to upload a CCDA/CCD document, the attack vector is local to the application, but the impact is that the victim’s session can be hijacked or exposed to unauthorized scripts through the preview functionality.