Description
A weakness has been identified in Orthanc Explorer 2 up to 1.12.0. The impacted element is an unknown function of the file WebApplication/src/components/StudyList.vue of the component URL Handler. This manipulation of the argument remote-source causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Patch name: 21f78ce5da668bf5233efcd1896ec7c6e3b22eae. Applying a patch is the recommended action to fix this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Orthanc | Explorer 2 | 1.0, 1.1, 1.2, 1.3, 1.4, 1.5, 1.6, 1.7, 1.8, 1.9, 1.10, 1.11, 1.12.0 | — |
References
- VDB-367430 | Orthanc Explorer 2 URL StudyList.vue cross site scripting vdb-entry technical-description
- VDB-367430 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- CVE-2026-10173 | CVE Analysis and Report third-party-advisory
- Submit #819559 | orthanc orthanc-server/orthanc-explorer-2 < = 1.12.0 Cross Site Scripting third-party-advisory
- https://github.com/orthanc-server/orthanc-explorer-2/issues/108 exploit issue-tracking
- https://github.com/rafaelsouzars/orthanc-explorer-2/commit/21f78ce5da668bf5233efcd1896ec7c6e3b22eae patch