The vulnerability (CVE-2026-40508) in OpenEMR prior to version 8.3.0 is a stored cross-site scripting flaw located in the patient portal template import handler. Authenticated attackers possessing Forms Administration permissions can upload templates embedding arbitrary HTML or JavaScript code. Because the uploaded content is not sanitized, the malicious scripts persist and execute in the context of any other Forms Administration user who opens the template in the HTML editor, potentially leading to session hijacking or other script-based attacks. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges and user interaction, with partial impact on confidentiality and integrity but no impact on availability.

Successful exploitation allows an authenticated user with Forms Administration permissions to inject malicious scripts that execute in the browsers of other privileged users. This can lead to partial confidentiality and integrity compromise within the affected OpenEMR environment. There is no indication of availability impact or known active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Forms Administration permissions to trusted users only and avoid opening untrusted templates in the HTML editor. Monitor vendor channels for updates regarding patches or official mitigations.