CVE-2026-40508: OpenEMR Stored XSS Vulnerability

CVE-2026-40508 Overview

CVE-2026-40508 is a stored cross-site scripting (XSS) vulnerability in OpenEMR versions before 8.3.0. The flaw resides in the patient portal template import handler, which fails to sanitize uploaded template files. Authenticated users holding Forms Administration permissions can upload template files containing arbitrary HTML or JavaScript. The malicious content is stored without sanitization and executes in the browser of any other Forms Administration user who opens the template in the HTML editor. The vulnerability is tracked as [CWE-79] and was patched in OpenEMR 8.3.0 by switching template content handling to HTMLPurifier.

Critical Impact
Authenticated attackers with Forms Administration privileges can inject persistent JavaScript that executes against other privileged users, enabling session theft, unauthorized actions, and lateral movement within the OpenEMR patient portal.

Affected Products

OpenEMR versions prior to 8.3.0
OpenEMR patient portal template import handler (portal/import_template.php)
OpenEMR Forms Administration HTML editor interface

Discovery Timeline

2026-08-19 - CVE-2026-40508 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-40508

Vulnerability Analysis

The vulnerability exists in the OpenEMR patient portal template import functionality. Specifically, portal/import_template.php accepts template files from users with Forms Administration permissions. The handler stores the uploaded content directly without applying HTML sanitization. When another Forms Administration user later views the template in the HTML editor, the browser renders the stored content, executing any embedded JavaScript.

Because the payload persists in the application's template store, every subsequent view of the affected template triggers the injected script. The stored nature of the flaw makes it more impactful than a reflected XSS, since exploitation does not require crafted links or social engineering per victim.

Root Cause

The root cause is missing output sanitization on template content stored through the import handler. OpenEMR did not apply an HTML filter such as HTMLPurifier to user-supplied template bodies before persistence or rendering. The fix commit ba316dd1d8de1291102da3f20f64240729ff899e refactors portal/import_template.php to route document template content through HTMLPurifier, removing dangerous tags and attributes before the content reaches the editor.

Attack Vector

Exploitation requires an authenticated account with Forms Administration permissions. The attacker uploads a template file containing an HTML or JavaScript payload through the patient portal template import handler. The payload is stored in OpenEMR's template repository. When a second Forms Administration user opens the template in the HTML editor, the payload executes in that user's browser under the OpenEMR origin.

php

// Patch reference from portal/import_template.php
// Source: https://github.com/openemr/openemr/commit/ba316dd1d8de1291102da3f20f64240729ff899e
// Before: template content was cast/echoed without HTML sanitization.
// After:  content is passed through HTMLPurifier before storage/rendering.
// PHPStan baseline delta shows adjustments in import_template.php:
$ignoreErrors[] = [
    'message' => '#^Parameter \#1 \$text of function text expects string, mixed given\.$#',
    'count' => 5, // reduced from 6
    'path' => __DIR__ . '/../../portal/import_template.php',
];

Detection Methods for CVE-2026-40508

Indicators of Compromise

Template files in the OpenEMR document template store containing <script>, onerror=, onload=, or javascript: sequences.
Unexpected outbound HTTP requests originating from Forms Administration user sessions immediately after opening a template in the HTML editor.
Newly created or modified templates uploaded via portal/import_template.php by low-tenure or non-clinical administrator accounts.

Detection Strategies

Review web server access logs for POST requests to portal/import_template.php and correlate them with the uploading account and file contents.
Scan the OpenEMR template database and filesystem storage for HTML event handler attributes or <script> tags in template bodies.
Inspect browser Content Security Policy (CSP) violation reports, if configured, for inline script execution originating from the template editor.

Monitoring Recommendations

Alert on any modification of Forms Administration role assignments and on template import activity outside of change windows.
Log and retain the raw payload of template uploads for forensic review, not just metadata.
Monitor authenticated Forms Administration sessions for anomalous DOM activity or unexpected API calls following template editor access.

How to Mitigate CVE-2026-40508

Immediate Actions Required

Upgrade OpenEMR to version 8.3.0 or later, which routes template content through HTMLPurifier.
Audit existing document templates for embedded scripts or HTML event handlers and remove any suspicious entries.
Review the Forms Administration role membership and revoke access from accounts that do not require template management.

Patch Information

The vulnerability is fixed in OpenEMR 8.3.0 via commit ba316dd1d8de1291102da3f20f64240729ff899e, which introduces HTMLPurifier-based sanitization for document template content in portal/import_template.php. See the GitHub Security Advisory GHSA-5293-8q47-cf44, the OpenEMR 8.3.0 release notes, and the VulnCheck stored XSS advisory for full technical details.

Workarounds

Restrict the Forms Administration role to a minimal set of trusted administrators until the patch is applied.
Temporarily disable the template import functionality in the patient portal if operationally acceptable.
Enforce a strict Content Security Policy on the OpenEMR application to block inline script execution in the HTML editor context.

bash

# Upgrade OpenEMR to the patched release
git fetch --tags
git checkout v8_3_0

# Verify the fix is present in the import handler
grep -n "HTMLPurifier" portal/import_template.php

# Optional: audit existing templates for suspicious content
grep -RniE "<script|onerror=|onload=|javascript:" /path/to/openemr/templates/