The vulnerability resides in OpenEMR’s patient portal template import handler where the GET parameter named templateHtml is reflected directly into the page output without any form of sanitization. The resulting reflected cross‑site scripting can execute arbitrary JavaScript in the context of the user’s browser. If an attacker injects a malicious payload into that parameter, any authenticated user with Forms Administration permissions who opens the crafted URL will have their session hijacked and potentially be able to perform arbitrary actions on behalf of that user.

OpenEMR products supplied by openemr:openemr are affected for all releases earlier than version 8.3.0. No specific sub‑versions are listed, so any deployment of OpenEMR before 8.3.0 that exposes the patient‑portal template import interface is vulnerable.

The CVSS score of 5.1 indicates a medium severity impact. EPSS score of 0.00243 indicates a very low likelihood of exploitation, and the vulnerability is not yet listed in CISA’s KEV catalog. The attack requires an authenticated user with Forms Administration rights to visit the malicious link, which narrows the exposure to a subset of users but still poses a significant risk to the integrity of those accounts. The vulnerability can be exploited by simply crafting a URL containing a malicious value for the templateHtml parameter and convincing or tricking the target user to open it.