CVE-2026-40508
MediumCVSS 5.4Summary
OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in the patient portal template import handler. Authenticated attackers with Forms Administration permissions can upload template files containing arbitrary HTML or JavaScript. Malicious scripts are stored without sanitization and execute in the browser of any other Forms Administration user who views the template in the HTML editor.
Risk Assessment
Stored XSS can lead to session hijacking of administrative users, data theft, or unauthorized actions within the system.
Recommendation
Update OpenEMR to version 8.3.0 or later to remediate this vulnerability.
Original NVD description (English source)
OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in the patient portal template import handler that allows authenticated attackers with Forms Administration permissions to upload template files containing arbitrary HTML or JavaScript. Attackers can inject malicious scripts through the template upload functionality, which are stored without sanitization and execute in the browser of any other Forms Administration user who views the template in the HTML editor.