CVE-2026-40508
Received Received - Intake

Stored XSS in OpenEMR Patient Portal Template Import

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: VulnCheck

Description
OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in the patient portal template import handler that allows authenticated attackers with Forms Administration permissions to upload template files containing arbitrary HTML or JavaScript. Attackers can inject malicious scripts through the template upload functionality, which are stored without sanitization and execute in the browser of any other Forms Administration user who views the template in the HTML editor.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-40508
EUVD
EUVD-2026-62508

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openemr openemr to 8.3.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-40508 is a stored cross-site scripting (XSS) vulnerability in OpenEMR versions before 8.3.0. It allows authenticated attackers with Forms Administration permissions to upload malicious template files containing HTML or JavaScript. These files are stored without sanitization and execute in the browsers of other Forms Administration users who view the template in the HTML editor.

Detection Guidance

Check for unauthorized template uploads in the /portal/import_template.php file. Review logs for suspicious HTML or JavaScript file uploads by Forms Administration users. Inspect stored templates in the database for unescaped scripts or event handlers like onerror or onload.

Impact Analysis

This vulnerability enables attackers to inject malicious scripts that can steal session cookies, capture credentials, or perform actions on behalf of users. Victims may experience unauthorized access to their accounts, data theft, or privilege escalation within the OpenEMR application.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive patient data, violating HIPAA's confidentiality requirements. It may also result in data breaches that could trigger GDPR's breach notification obligations and potential fines for inadequate security measures.

Mitigation Strategies

Upgrade to OpenEMR version 8.3.0 or later immediately. If upgrading is not possible, apply the HTMLPurifier sanitization patch to /portal/import_template.php and ensure all template content is validated and sanitized before storage.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-40508. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart