CVE-2026-40508CWE-79cross-site-scripting

CVE-2026-40508

Medium · published August 19, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
21.4
In the wild
Unconfirmed
What it is

OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in the patient portal template import handler that allows authenticated attackers with Forms Administration permissions to upload template files containing arbitrary HTML or JavaScript. Attackers can inject malicious scripts through the template upload functionality, which are stored without sanitization and execute in the browser of any other Forms Administration user who views the template in the HTML editor.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
5.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS
0.00298 · 21.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-08-19T19:17Z
References (5)
https://github.com/openemr/openemr/commit/ba316dd1d8de1291102da3f20f64240729ff899e · [email protected]https://github.com/openemr/openemr/releases/tag/v8_3_0 · [email protected]https://github.com/openemr/openemr/security/advisories/GHSA-5293-8q47-cf44 · [email protected]https://www.vulncheck.com/advisories/openemr-stored-xss-via-patient-portal-template-import-handler · [email protected]https://github.com/openemr/openemr/security/advisories/GHSA-5293-8q47-cf44 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 19 AUG 14:51Z
    OpenEMR < 8.3.0 Stored XSS via Patient Portal Template Import Handler
    cvelistv5