CVE-2026-62293
MediumCVSS 5.0Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
HAPI FHIR prior to 6.9.11 contains a stored cross-site scripting vulnerability in the hidden scan command, which concatenates attacker-controlled titles and source references without escaping in Scanner.java. A user scanning a malicious IG/profile and opening the generated HTML report can trigger stored XSS, executing attacker-controlled JavaScript in the report's browser context.
Risk Assessment
An attacker could execute arbitrary JavaScript in the victim's browser, potentially leading to data theft or session hijacking.
Recommendation
Upgrade HAPI FHIR to version 6.9.11 or later, which includes a fix.
Original NVD description (English source)
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the hidden scan command concatenates attacker-controlled Implementation Guide titles, profile titles, and source references into scan.html without escaping in Scanner.java. As a result, a user who scans an attacker-supplied IG/profile and then opens or publishes the generated local/CI HTML report can trigger stored cross-site scripting, executing attacker-controlled JavaScript in the report's browser context. This issue is fixed in version 6.9.11.