---
id: CVE-2026-62293
title: >-
  HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare
  interoperability in Java
summary: >-
  HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare
  interoperability in Java. Prior to 6.9.11, the hidden scan command
  concatenates attacker-controlled Implementation Guide titles, profile titles,
  and source re…
severity: medium
cvss: 5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-20
  - CWE-79
published: '2026-08-07'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:02:22.660'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-62293'
references:
  - url: >-
      https://github.com/hapifhir/org.hl7.fhir.core/commit/3a9befd8845f003095ed75f4b24b9a80630275be
    label: security-advisories@github.com
  - url: >-
      https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-6vcw-fq7v-4vhw
    label: security-advisories@github.com
  - url: >-
      https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-6vcw-fq7v-4vhw
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00167
epssPercentile: 0.05279
ingestedAt: '2026-09-09T21:22:45.524Z'
---

## Overview

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the hidden scan command concatenates attacker-controlled Implementation Guide titles, profile titles, and source references into scan.html without escaping in Scanner.java. As a result, a user who scans an attacker-supplied IG/profile and then opens or publishes the generated local/CI HTML report can trigger stored cross-site scripting, executing attacker-controlled JavaScript in the report's browser context. This issue is fixed in version 6.9.11.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.