CVE-2026-25860

Vulnerability

OpenClinic GA versions up to and including 5.351.19 contain a reflected cross-site scripting vulnerability in the DICOM image upload handler. The archiving/uploadfiles.jsp script processes uploaded DICOM files and renders metadata fields such as StudyDescription without proper output encoding [1][2][3]. This allows an attacker to inject arbitrary JavaScript into the web page when the uploaded file is processed.

Exploitation

An attacker can craft a malicious DICOM file containing JavaScript payloads in metadata fields like StudyDescription. The attacker then needs to convince an authenticated victim to upload this DICOM file via the Upload DICOM images feature. When the server reflects the metadata in popup.jsp or uploadfiles.jsp, the payload executes in the victim's browser [1][2].

Impact

Successful exploitation leads to arbitrary JavaScript execution in the context of the victim's session, potentially allowing the attacker to perform actions such as modifying configuration settings or exfiltrating data. Reference [1] describes chaining this XSS with other functionality to achieve remote code execution via storePicture.jsp parameter manipulation.

Mitigation

As of the publication date, no official patch has been released by the vendor. Users are advised to restrict access to the DICOM upload feature to trusted users only, and to consider input validation or output encoding modifications as a temporary workaround. The vulnerability affects OpenClinic GA <=5.351.19 [2][3].