CVE-2026-40507: OpenEMR Reflected XSS Vulnerability

CVE-2026-40507 Overview

CVE-2026-40507 is a reflected cross-site scripting (XSS) vulnerability in OpenEMR versions prior to 8.3.0. The flaw resides in the patient portal template import handler, where the templateHtml GET parameter is reflected into the page response without sanitization. An attacker can craft a malicious URL that executes arbitrary JavaScript in the browser of any authenticated user with Forms Administration permissions who visits the link. Successful exploitation enables session hijacking against privileged OpenEMR users. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Attackers can hijack authenticated sessions of OpenEMR users holding Forms Administration privileges, gaining access to sensitive healthcare data and administrative functions.

Affected Products

OpenEMR versions prior to 8.3.0
OpenEMR patient portal import_template.php handler
Deployments exposing the patient portal to network-reachable clients

Discovery Timeline

2026-08-19 - CVE-2026-40507 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-40507

Vulnerability Analysis

The vulnerability affects portal/import_template.php in OpenEMR, a widely deployed open-source electronic health records platform. The handler accepts a templateHtml GET parameter intended to preview or import document template content. Prior to version 8.3.0, this parameter was echoed into the HTTP response without HTML encoding or content filtering. Any script payload supplied through the URL executes in the browsing context of the authenticated victim. Because Forms Administration is a privileged role, hijacked sessions grant broad access to template management and downstream administrative workflows.

Root Cause

The root cause is missing output encoding on user-controlled input. The import_template.php script cast and rendered mixed input directly into the HTML response, allowing tag and attribute injection. The upstream fix routes template content through HTMLPurifier, a library that whitelists safe HTML constructs and strips executable script contexts.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker crafts a URL containing a JavaScript payload in the templateHtml parameter and delivers it through phishing, chat, or a linked page. When an authenticated user with Forms Administration permissions clicks the link, the payload executes under the OpenEMR origin. The script can exfiltrate session cookies, issue authenticated requests, or pivot to modify template content.

php

// Patch reference from .phpstan/baseline/argument.type.php
$ignoreErrors[] = [
    'message' => '#^Parameter \\#1 \\$text of function text expects string, mixed given\\.$#',
-   'count' => 6,
+   'count' => 5,
    'path' => __DIR__ . '/../../portal/import_template.php',
];
// Source: https://github.com/openemr/openemr/commit/ba316dd1d8de1291102da3f20f64240729ff899e
// The commit "refactor(portal): use HTMLPurifier for document template content"
// replaces unsanitized reflection with purified output in import_template.php.

Detection Methods for CVE-2026-40507

Indicators of Compromise

HTTP requests to portal/import_template.php containing templateHtml parameter values with <script>, onerror=, onload=, or javascript: substrings
Web server access logs showing long or URL-encoded templateHtml query strings originating from external referrers
Unexpected session activity or template modifications performed by Forms Administration accounts shortly after clicking external links

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the templateHtml GET parameter for HTML tags, event handlers, and encoded script fragments
Correlate outbound requests from browsers on administrator workstations against OpenEMR session cookies to identify token exfiltration
Review OpenEMR audit logs for template import actions initiated from unusual referrers or client IPs

Monitoring Recommendations

Alert on any HTTP 200 response from import_template.php where the request query contains angle brackets or %3C%73%63%72%69%70%74
Baseline normal Forms Administration activity and flag anomalous template imports outside business hours
Ingest OpenEMR application and web server logs into a centralized SIEM for cross-source correlation

How to Mitigate CVE-2026-40507

Immediate Actions Required

Upgrade OpenEMR to version 8.3.0 or later, which introduces HTMLPurifier-based sanitization for template content
Rotate session tokens and credentials for accounts with Forms Administration privileges if suspicious template imports are observed
Restrict access to the patient portal management interfaces to trusted networks or VPN-connected clients

Patch Information

The fix is delivered in OpenEMR v8.3.0. The relevant commit ba316dd refactors portal/import_template.php to route document template content through HTMLPurifier and removes dead code paths. Refer to the GitHub Security Advisory GHSA-rmmr-8498-463g and the VulnCheck XSS Advisory for full technical context.

Workarounds

Block or filter HTTP requests to portal/import_template.php at the reverse proxy or WAF until the patch is applied
Enforce a strict Content-Security-Policy header that disallows inline scripts on OpenEMR responses
Train Forms Administration users to avoid clicking OpenEMR links from untrusted sources and to verify URLs before authentication

bash

# Example nginx rule to block suspicious templateHtml parameter values
location /portal/import_template.php {
    if ($arg_templateHtml ~* "(<|%3C)(script|img|svg|iframe)") {
        return 403;
    }
    # Content-Security-Policy hardening for the patient portal
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'";
}