What’s Vulnerable › Vulnerabilities

CVE-2026-25860: OpenClinic GA 5.351.19 Reflected XSS via DICOM Image Upload Handler

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-09 · updated 2026-07-23
• Weakness: CWE-79

Description

OpenClinic GA 5.351.19 contains a reflected cross-site scripting vulnerability in the DICOM image upload handler that allows attackers to execute arbitrary JavaScript in a victim's browser by embedding malicious payloads in DICOM file metadata fields. Attackers can craft a DICOM file with JavaScript payloads in metadata fields such as Study Description, which are reflected without sanitization in popup.jsp and archiving/uploadfiles_jsp.java when processed through the Upload DICOM images feature.

Affected products

• frankverbeke OpenClinic GA: through 5.351.19

References

• https://github.com/partywavesec/CVE-2026-25860
• https://www.partywave.site/show/research/cve-2026-25860-openclinic-ga-xss-to-rce
• https://www.vulncheck.com/advisories/openclinic-ga-reflected-xss-via-dicom-image-upload-handler

Get alerted when CVE-2026-25860 or the next vulnerability affects your stack