CVE-2026-40508: OpenEMR < 8.3.0 Stored XSS via Patient Portal Template Import Handler
OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in the patient portal template import handler that allows authenticated attackers with Forms Administration permissions to upload template files containing arbitrary HTML or JavaScript. Attackers can inject malicious scripts through the template upload functionality, which are stored without sanitization and execute in the browser of any other Forms Administration user who views the template in the HTML editor.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
OpenEMR deployments before 8.3.0 are affected where users have Forms Administration permissions and use the patient portal template import and HTML editor functionality. The stored payload executes when another Forms Administration user views the affected template in the HTML editor.
What does an attacker need to exploit it?
An attacker needs an authenticated OpenEMR account with Forms Administration permissions. They must also be able to upload a patient portal template containing malicious HTML or JavaScript; a target Forms Administration user must then view that template in the HTML editor.
Are users without Forms Administration permissions directly targeted by the described trigger?
The described execution path affects Forms Administration users viewing the template in the HTML editor. The provided information does not identify execution in browsers of other user roles.
What can be done if upgrading is not immediately possible?
Restrict Forms Administration permissions and prevent untrusted users from uploading patient portal template files. Review imported templates for arbitrary HTML or JavaScript before Forms Administration users open them in the HTML editor.