CVE-2026-40508
mediumOpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in the patient portal template import handler that allows authenticated attackers wit…
OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in the patient portal template import handler that allows authenticated attackers with Forms Administration permissions to upload template files containing arbitrary HTML or JavaScript. Attackers can inject malicious scripts through the template upload functionality, which are stored without sanitization and execute in the browser of any other Forms Administration user who views the template in the HTML editor.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/openemr/openemr/commit/ba316dd1d8de1291102da3f20f64240729ff899e disclosure@vulncheck.com
- https://github.com/openemr/openemr/releases/tag/v8_3_0 disclosure@vulncheck.com
- https://github.com/openemr/openemr/security/advisories/GHSA-5293-8q47-cf44 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/openemr-stored-xss-via-patient-portal-template-import... disclosure@vulncheck.com
- https://github.com/openemr/openemr/security/advisories/GHSA-5293-8q47-cf44 134c704f-9b21-4f2e-91b3-4a467353bcc0