Medium severity · published Aug 19, 2026
CVE-2026-40508
OpenEMR < 8.3.0 Stored XSS via Patient Portal Template Import Handler
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in the patient portal template import handler that allows authenticated attackers with Forms Administration permissions to upload template files containing arbitrary HTML or JavaScript. Attackers can inject malicious scripts through the template upload functionality, which are stored without sanitization and execute in the browser of any other Forms Administration user who views the template in the HTML editor.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
openemr · openemr
before 8.3.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-40508
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-40508
vendor-advisory
https://github.com/openemr/openemr/security/advisories/GHSA-5293-8q47-cf44
release-notes
https://github.com/openemr/openemr/releases/tag/v8_3_0
patch
https://github.com/openemr/openemr/commit/ba316dd1d8de1291102da3f20f64240729ff899e
third-party-advisory
https://www.vulncheck.com/advisories/openemr-stored-xss-via-patient-portal-template-import-handler
More from openemr
9.9
CVE-2026-24848
OpenEMR Arbitrary File Write leading to Remote Code Execution
9.8
CVE-2026-24898
OpenEMR has an Unauthenticated MedEx Token Disclosure
9.8
CVE-2024-37734
An issue in OpenEMR 7.0.2 allows a remote attacker to escalate privileges viaa crafted POST request using the noteid parameter
9.1
CVE-2026-39932
OpenEMR 8.2.0 Remote Code Execution via CategoryTree eval() Injection
9.1
CVE-2026-32238
OpenEMR has Remote Code Execution in backup functionality