CVE-2026-40508Published
OpenEMR < 8.3.0 Stored XSS via Patient Portal Template Import Handler
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-40508 · Microsoft / collected KEV context
cve-program · CVE-2026-40508
- https://github.com/openemr/openemr/security/advisories/GHSA-5293-8q47-cf44
- https://github.com/openemr/openemr/releases/tag/v8_3_0
- https://github.com/openemr/openemr/commit/ba316dd1d8de1291102da3f20f64240729ff899e
- https://www.vulncheck.com/advisories/openemr-stored-xss-via-patient-portal-template-import-handler
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.