Description
OpenClinic GA 5.351.19 contains a reflected cross-site scripting vulnerability in the DICOM image upload handler that allows attackers to execute arbitrary JavaScript in a victim's browser by embedding malicious payloads in DICOM file metadata fields. Attackers can craft a DICOM file with JavaScript payloads in metadata fields such as Study Description, which are reflected without sanitization in popup.jsp and archiving/uploadfiles_jsp.java when processed through the Upload DICOM images feature.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| frankverbeke | OpenClinic GA | ≤ 5.351.19 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
partywavesec/CVE-2026-25860 ★ 0 · Jun 5, 2026
CVE-2026-25860 POC git
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- https://www.partywave.site/show/research/cve-2026-25860-openclinic-ga-xss-to-rce technical-description exploit
- https://github.com/partywavesec/CVE-2026-25860 technical-description exploit
- https://www.vulncheck.com/advisories/openclinic-ga-reflected-xss-via-dicom-image-upload-handler third-party-advisory