CVE-2026-40509

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.3.0

Description A cross-site request forgery issue exists in the DICOM viewer. The web path GET parameter in the DICOM viewer page is embedded as a URL without proper sanitization or validation against expected path formats. This allows an attacker to craft a URL that forces an authenticated user with Patients - Documents permissions to make authenticated requests to arbitrary OpenEMR endpoints, which can lead to forced logout and other state-changing actions.

Recommendations Update to version 8.3.0 or later. Avoid using the web path parameter in the DICOM viewer page until the update is applied.