Is CVE-2026-40507 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-40507?

CVE-2026-40507 has a CVSS v3 severity of MEDIUM (6.1).

Back

CVE-2026-40507

Description

OpenEMR before 8.3.0 contains a reflected cross-site scripting vulnerability in the patient portal template import handler. The templateHtml GET parameter is reflected into the page response without sanitization. An attacker can craft a URL that executes arbitrary JavaScript in the browser of any authenticated user with Forms Administration permissions who visits the link, enabling session hijacking.