CVE-2026-40509

OpenEMR before 8.3.0 contains a cross-site request forgery vulnerability in the DICOM viewer. The web_path GET parameter in the DICOM viewer page is embedded unsanitized as a URL without validation against expected path formats. An attacker can craft a URL that causes an authenticated user with Patients - Documents permissions to make authenticated requests to arbitrary OpenEMR endpoints, enabling forced logout and other state-changing actions.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/openemr/openemr/commit/f760adc7bddaf9d118e1a0d40590e686783ed21b
https://github.com/openemr/openemr/releases/tag/v8_3_0
https://github.com/openemr/openemr/security/advisories/GHSA-wffp-pj5h-xqwp
https://www.vulncheck.com/advisories/openemr-csrf-via-dicom-viewer-web-path-parameter

Configurations

No configuration.

History

27 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) OpenEMR antes de la versión 8.3.0 contiene una vulnerabilidad de falsificación de petición en sitios cruzados en el visor DICOM. El parámetro GET web_path en la página del visor DICOM se incrusta sin sanear como una URL sin validación contra formatos de ruta esperados. Un atacante puede crear una URL que hace que un usuario autenticado con permisos de Pacientes - Documentos realice peticiones autenticadas a puntos finales arbitrarios de OpenEMR, lo que permite el cierre de sesión forzado y otras acciones que cambian el estado.

Information

Published : 2026-08-19 15:17

Updated : 2026-10-27 13:10

NVD link : CVE-2026-40509

Mitre link : CVE-2026-40509

CVE.ORG link : CVE-2026-40509

JSON object : View

Products Affected

No product.

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2026-40509", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40509", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-20T13:48:15.790828Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/openemr/openemr", "vendor": "openemr", "product": "openemr", "versions": [{"status": "affected", "version": "0", "lessThan": "8.3.0", "versionType": "semver"}], "packageURL": "pkg:github/openemr/openemr", "defaultStatus": "affected"}]}], "published": "2026-08-19T15:17:01.867", "references": [{"url": "https://github.com/openemr/openemr/commit/f760adc7bddaf9d118e1a0d40590e686783ed21b", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/openemr/openemr/releases/tag/v8_3_0", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/openemr/openemr/security/advisories/GHSA-wffp-pj5h-xqwp", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/openemr-csrf-via-dicom-viewer-web-path-parameter", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "OpenEMR before 8.3.0 contains a cross-site request forgery vulnerability in the DICOM viewer. The web_path GET parameter in the DICOM viewer page is embedded unsanitized as a URL without validation against expected path formats. An attacker can craft a URL that causes an authenticated user with Patients - Documents permissions to make authenticated requests to arbitrary OpenEMR endpoints, enabling forced logout and other state-changing actions."}, {"lang": "es", "value": "OpenEMR antes de la versi\u00f3n 8.3.0 contiene una vulnerabilidad de falsificaci\u00f3n de petici\u00f3n en sitios cruzados en el visor DICOM. El par\u00e1metro GET web_path en la p\u00e1gina del visor DICOM se incrusta sin sanear como una URL sin validaci\u00f3n contra formatos de ruta esperados. Un atacante puede crear una URL que hace que un usuario autenticado con permisos de Pacientes - Documentos realice peticiones autenticadas a puntos finales arbitrarios de OpenEMR, lo que permite el cierre de sesi\u00f3n forzado y otras acciones que cambian el estado."}], "lastModified": "2026-10-27T13:10:00.360", "sourceIdentifier": "disclosure@vulncheck.com"}