CVE-2026-25860

Name of the Vulnerable Software and Affected Versions OpenClinic GA version 5.351.19

Description A reflected cross-site scripting issue exists in the DICOM image upload handler. Attackers can execute arbitrary JavaScript in a victim's browser by embedding malicious payloads in DICOM file metadata fields, such as Study Description. These payloads are reflected without sanitization in 'popup.jsp' and 'archiving/uploadfiles jsp.java' when processed through the Upload DICOM images feature. This flaw can be chained to achieve remote code execution (RCE), which is the ability to execute arbitrary commands on a target machine.

Recommendations As a temporary workaround, restrict access to the Upload DICOM images feature or avoid uploading DICOM files from untrusted sources until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.