Security Advisory

CVE-2026-40509

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-08-19 14:53:21

Last updated 2026-08-21 11:20:53

Assigner VulnCheck

CVSS score 5.3

State PUBLISHED

Description

OpenEMR before 8.3.0 contains a cross-site request forgery vulnerability in the DICOM viewer. The web_path GET parameter in the DICOM viewer page is embedded unsanitized as a URL without validation against expected path formats. An attacker can craft a URL that causes an authenticated user with Patients - Documents permissions to make authenticated requests to arbitrary OpenEMR endpoints, enabling forced logout and other state-changing actions.

← Browse all CVEs View on cve.org ↗