CVE-2026-40507: OpenEMR < 8.3.0 Reflected XSS via templateHtml Parameter in Patient Portal
OpenEMR before 8.3.0 contains a reflected cross-site scripting vulnerability in the patient portal template import handler. The templateHtml GET parameter is reflected into the page response without sanitization. An attacker can craft a URL that executes arbitrary JavaScript in the browser of any authenticated user with Forms Administration permissions who visits the link, enabling session hijacking.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenEMRto a version that resolves this vulnerability.Fixed in 8.3.0 - Compensating control
Block or do not allow the patient portal template import handler requests that include the templateHtml GET parameter until OpenEMR is upgraded to 8.3.0 or later.
Event History
Frequently Asked Questions
Who can be targeted by this issue?
An attacker can target authenticated OpenEMR users who have Forms Administration permissions. Exploitation requires persuading such a user to visit a crafted URL.
Does exploitation require the attacker to authenticate or have administrative permissions?
No attacker authentication or privileges are required. The attacker needs to craft a URL containing malicious content in the templateHtml GET parameter and induce a Forms Administration user to open it.
What is the impact if exploitation succeeds?
The crafted script executes in the targeted user's browser. This can enable session hijacking and affect the confidentiality and integrity of actions available through that user's session.
Which versions are affected?
OpenEMR versions before 8.3.0 are affected. Version 8.3.0 is identified as the release containing the fix.