EUVD-2026-33493
GHSA-r68q-jr9v-43rv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A weakness has been identified in Orthanc Explorer 2 up to 1.12.0. The impacted element is an unknown function of the file WebApplication/src/components/StudyList.vue of the component URL Handler. This manipulation of the argument remote-source causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Patch name: 21f78ce5da668bf5233efcd1896ec7c6e3b22eae. Applying a patch is the recommended action to fix this issue.
AnalysisAI
Cross-site scripting in Orthanc Explorer 2 versions up to and including 1.12.0 enables remote attackers to inject arbitrary JavaScript into the browser sessions of users who load a crafted URL, via the unsanitized remote-source query parameter processed by the StudyList.vue URL Handler. The CVSS 4.3 rating (AV:N/AC:L/PR:N/UI:R/S:U) reflects that no authentication is required of the attacker but victim interaction with a malicious link is necessary - a classic reflected XSS profile. Publicly available exploit code exists per VulDB and a referenced GitHub issue, and an upstream patch commit has been issued, though no officially tagged patched release has been independently confirmed from the canonical repository.
Technical ContextAI
Orthanc Explorer 2 is a Vue.js single-page application providing a web-based DICOM study management and viewer interface (CPE: cpe:2.3:a:orthanc:explorer_2:*:*:*:*:*:*:*:*). The affected component is the URL Handler within WebApplication/src/components/StudyList.vue, which processes the remote-source query parameter and renders its value into the DOM without adequate output encoding. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause class: user-controlled input from the URL is interpolated into a rendered template or DOM context without sanitization, enabling script injection. Notably, the patch commit (21f78ce5da668bf5233efcd1896ec7c6e3b22eae) modifies only package-lock.json, upgrading vue-i18n from ^9.14.5 to ^11.0.1 alongside esbuild and Babel build toolchain components - suggesting the root cause may involve unsafe value interpolation behavior in vue-i18n v9 rather than, or in addition to, an application-level encoding deficiency directly in StudyList.vue itself.
RemediationAI
Apply patch commit 21f78ce5da668bf5233efcd1896ec7c6e3b22eae, which upgrades vue-i18n from ^9.14.5 to ^11.0.1 and updates associated build toolchain packages; however, this commit originates from a third-party fork (rafaelsouzars/orthanc-explorer-2) rather than the canonical orthanc-server/orthanc-explorer-2 repository, and no officially tagged patched release version has been independently confirmed - administrators should verify fix availability and official release status against https://github.com/orthanc-server/orthanc-explorer-2/issues/108 before deploying. As a compensating control where patching is delayed, restrict access to Orthanc Explorer 2 to internal networks or authenticated VPN sessions to prevent external actors from distributing crafted malicious links; this reduces the attacker's delivery surface but does not eliminate insider or social-engineering risk within the permitted network segment. A Web Application Firewall rule blocking or stripping the remote-source query parameter on inbound requests provides an additional defensive layer, though WAF rules can be bypassed through encoding variations and must not substitute for the upstream fix.
Heap buffer overflow in Orthanc DICOM Server (versions ≤1.12.10) allows unauthenticated remote code execution via malfor
Heap buffer overflow in Orthanc DICOM Server ≤1.12.10 allows unauthenticated remote attackers to achieve arbitrary code
Orthanc server prior to version 1.5.8 does not enable basic authentication by default when remote access is enabled. Rat
Out-of-bounds heap read in Orthanc DICOM Server ≤1.12.10 allows unauthenticated remote attackers to extract heap memory
Orthanc before 1.12.0 allows authenticated users with access to the Orthanc API to overwrite arbitrary files on the file
Memory exhaustion in Orthanc DICOM Server versions up to 1.12.10 allows remote unauthenticated attackers to crash the se
Memory exhaustion in Orthanc DICOM Server versions ≤1.12.10 allows remote attackers to trigger denial of service by uplo
Memory exhaustion in Orthanc DICOM Server ≤1.12.10 allows unauthenticated remote attackers to trigger denial-of-service
Out-of-bounds read in Orthanc DICOM Server's DicomStreamReader allows remote unauthenticated attackers to trigger denial
Heap out-of-bounds write in Orthanc DICOM Server allows a low-privileged network attacker to corrupt memory by supplying
Heap buffer overflow in Orthanc DICOM Server (versions ≤1.12.10) allows local attackers to corrupt data or crash the ser
Out-of-bounds read in Orthanc DICOM Server's Philips PMSCT_RLE1 decompression allows local attackers to leak heap memory
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today