Vulnerability · Published Aug 19, 2026 · Assigned by VulnCheck

CVE-2026-40507OpenEMR < 8.3.0 Reflected XSS via templateHtml Parameter in Patient Portal

Medium 6.1

In plain English

A medium-severity cross-site scripting in openemr from openemr. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.3%top 72.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

OpenEMR before 8.3.0 contains a reflected cross-site scripting vulnerability in the patient portal template import handler. The templateHtml GET parameter is reflected into the page response without sanitization. An attacker can craft a URL that executes arbitrary JavaScript in the browser of any authenticated user with Forms Administration permissions who visits the link, enabling session hijacking.

Affected products (as reported)

Vendor	Product	Versions
openemr	openemr	0 – before 8.3.0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

GitHub Security Advisory (GHSA-rmmr-8498-463g) vendor-advisory
OpenEMR v8_3_0 Release Notes release-notes
Patch Commit patch
https://www.vulncheck.com/advisories/openemr-reflected-xss-via-templatehtml-parameter-in-patient-portal third-party-advisory