CVE-2026-40508: 
OpenEMR vulnerability analysis and mitigation

CVE-2026-40508 is a stored cross-site scripting (XSS) vulnerability in OpenEMR's patient portal template import handler (/portal/import_template.php). It affects all OpenEMR versions before 8.3.0 and allows authenticated attackers with Forms Administration permissions to upload template files containing arbitrary HTML or JavaScript that executes in the browsers of other Forms Administration users. The vulnerability was published on August 19, 2026, with a patch released in OpenEMR 8.3.0. It carries a CVSS v3.1 base score of 5.4 (Medium) and a CVSS v4.0 base score of 5.1 (Medium) (GitHub Advisory, Github Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a failure to sanitize uploaded template file content before storage and rendering. When a template is uploaded via POST /portal/import_template.php, the file content is stored by DocumentTemplateService.uploadTemplate() without HTML/JavaScript sanitization — bypassing the tag check that exists only for templates created or edited through the editor UI. When any Forms Administration user subsequently views the template via mode=editor_render_html, the content is fetched and passed directly to renderEditorHtml() without sanitization, allowing event-handler attributes (e.g., onerror, onload) to execute. The fix introduced DocumentTemplateService::purifyTemplateContent() using HTMLPurifier, applied at both write and render time (GitHub Advisory, Fix Commit).

Successful exploitation enables persistent JavaScript execution in the browser sessions of other Forms Administration users who view the malicious template, enabling session hijacking, credential theft, and unauthorized actions performed on behalf of those administrators. Because OpenEMR handles sensitive protected health information (PHI), a compromised administrative session could expose patient records, facilitate further privilege escalation within the application, or be used to tamper with clinical data. Availability is not directly impacted, but confidentiality and integrity of both the application and patient data are at risk (GitHub Advisory, Github Advisory).

A proof-of-concept (PoC) script (PLT-2026-05-01.py) that automates template upload and provides the trigger URL is referenced in the official advisory, and NVD's SSVC assessment classifies exploitation status as "poc" (GitHub Advisory). However, there is no current evidence of in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.171% (7th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access with Forms Administration privileges, limiting the attacker pool (Github Advisory).

1. Obtain credentials: Acquire or compromise an OpenEMR account with Administration – Forms Administration permissions on a target instance running a version prior to 8.3.0.
2. Craft malicious template: Create an HTML file containing an XSS payload using event-handler attributes to bypass any basic tag filtering, e.g., <img src=x onerror=alert(document.cookie)> or a more sophisticated payload to exfiltrate session cookies to an attacker-controlled server.
3. Upload the template: Authenticate to OpenEMR and submit a POST request to /portal/import_template.php with the malicious file in the template_files[] parameter. The file content is stored without sanitization via DocumentTemplateService.uploadTemplate().
4. Retrieve the template ID: Note the docid assigned to the uploaded template from the application response or by querying the template list.
5. Trigger execution: Direct another Forms Administration user (or wait for one) to navigate to http://<host>:<port>/portal/import_template.php?mode=editor_render_html&docid=<template_id>. The stored payload executes in their browser context.
6. Harvest session data: The injected script exfiltrates session cookies or performs actions (e.g., account modification, data access) on behalf of the victim administrator (GitHub Advisory).

• Network: Unexpected outbound HTTP requests from the OpenEMR server or from administrator browsers to external/unknown hosts shortly after a template is viewed; unusual POST requests to /portal/import_template.php with HTML file uploads containing script-related content.
• Logs: Web server access logs showing POST requests to /portal/import_template.php with template_files[] parameters followed by GET requests to the same endpoint with mode=editor_render_html; repeated access to the editor_render_html mode for a specific docid by multiple user accounts.
• File System: Newly uploaded template files in the OpenEMR document templates storage directory containing <script>, onerror=, onload=, or javascript: strings.
• Application: Unexpected template entries in the document_templates database table with HTML content containing event-handler attributes or JavaScript URIs (GitHub Advisory).

The primary remediation is to upgrade OpenEMR to version 8.3.0 or later, which introduces HTMLPurifier-based sanitization (DocumentTemplateService::purifyTemplateContent()) applied at both template write and render time (OpenEMR Release, Fix Commit). As interim mitigations: restrict Forms Administration permissions to the minimum number of trusted users; implement Content Security Policy (CSP) headers to limit inline script execution in the HTML editor; and audit existing uploaded templates for malicious content. No official workaround short of upgrading has been provided by the vendor.