PT-2026-48279 · Frankverbeke · Openclinic Ga

Partywave + 1 · Published 2026-06-09 · Updated 2026-06-09 · CVE-2026-25860

Mitre

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

OpenClinic GA 5.351.19 contains a reflected cross-site scripting vulnerability in the DICOM image upload handler that allows attackers to execute arbitrary JavaScript in a victim's browser by embedding malicious payloads in DICOM file metadata fields. Attackers can craft a DICOM file with JavaScript payloads in metadata fields such as Study Description, which are reflected without sanitization in popup.jsp and archiving/uploadfiles jsp.java when processed through the Upload DICOM images feature.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-25860

Affected Products

Openclinic Ga

References · 4

• 🔥 https://github.com/partywavesec/CVE-2026-25860 · Exploit
• 🔥 https://partywave.site/show/research/cve-2026-25860-openclinic-ga-xss-to-rce · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-25860 · Security Note
• https://vulncheck.com/advisories/openclinic-ga-reflected-xss-via-dicom-image-upload-handler · Note