Read the docs
TI-2026-44482 Aliases CVE-2026-62293

HAPI FHIR: Stored XSS in scan report via unescaped IG and profile titles

Priority MEDIUM 56CWE-20Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the hidden scan command concatenates attacker-controlled Implementation Guide titles, profile titles, and source references into scan.html without escaping in Scanner.java. As a result, a user who scans an attacker-supplied IG/profile and then opens or publishes the generated local/CI HTML report can trigger stored cross-site scripting, executing attacker-controlled JavaScript in the report's browser context. This issue is fixed in version 6.9.11.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00167 5th percentileScored 2026-11-07
Fix Fixed org.hl7.fhir.core (hapifhir): 6.9.11ca.uhn.hapi.fhir:org.hl7.fhir.validation (hapifhir): 6.9.11+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
hapifhirorg.hl7.fhir.corebefore 6.9.116.9.11Patch availableCNA
hapifhirca.uhn.hapi.fhir:org.hl7.fhir.validationbefore 6.9.116.9.11Patch availableCNA
hapifhirca.uhn.hapi.fhir:org.hl7.fhir.validation.clibefore 6.9.116.9.11Patch availableCNA
  • org.hl7.fhir.core Vendorhapifhir Affected before 6.9.11 Fixed in 6.9.11 Patch available CNA
  • ca.uhn.hapi.fhir:org.hl7.fhir.validation Vendorhapifhir Affected before 6.9.11 Fixed in 6.9.11 Patch available CNA
  • ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli Vendorhapifhir Affected before 6.9.11 Fixed in 6.9.11 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:hapifhir:hl7_fhir_core:*:*:*:*:*:*:*:*——hapifhir
  • cpe:2.3:a:hapifhir:hl7_fhir_core:*:*:*:*:*:*:*:* Versions — — ·hapifhir

Remediation

  • Fix · CNA org.hl7.fhir.core (hapifhir) Fixed in 6.9.11
  • Fix · CNA ca.uhn.hapi.fhir:org.hl7.fhir.validation (hapifhir) Fixed in 6.9.11
  • Fix · CNA ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli (hapifhir) Fixed in 6.9.11

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-62293

References

Other 2

  • TI-2026-26647 HAPI FHIR: Unauthenticated SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft CVSS 3.1CRITICAL 9.3
  • TI-2026-40028 HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory CVSS 4.0HIGH 8.7
  • TI-2026-26645 HAPI FHIR: Authentication Credential Leakage via Improper URL Prefix Matching on HTTP Redirect in HAPI FHIR Core CVSS 3.1CRITICAL 9.1
  • TI-2026-56488 HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service CVSS 3.1HIGH 7.5
  • TI-2026-56487 HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service CVSS 3.1HIGH 7.5
  • TI-2026-44485 HAPI FHIR: XHTML narrative parser unbounded recursion causes StackOverflow denial of service CVSS 3.1HIGH 7.5
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences