EUVD-2026-35842
GHSA-fr6h-hjqh-g695
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
OpenClinic GA 5.351.19 contains a reflected cross-site scripting vulnerability in the DICOM image upload handler that allows attackers to execute arbitrary JavaScript in a victim's browser by embedding malicious payloads in DICOM file metadata fields. Attackers can craft a DICOM file with JavaScript payloads in metadata fields such as Study Description, which are reflected without sanitization in popup.jsp and archiving/uploadfiles_jsp.java when processed through the Upload DICOM images feature.
AnalysisAI
Reflected cross-site scripting in OpenClinic GA 5.351.19's DICOM image upload handler allows unauthenticated remote attackers to execute arbitrary JavaScript in authenticated users' browsers by embedding payloads in DICOM file metadata fields such as Study Description, which are reflected unsanitized through popup.jsp and archiving/uploadfiles_jsp.java. A publicly available proof-of-concept exists, and the researcher's published chain explicitly demonstrates escalation from this XSS primitive to remote code execution, materially elevating the real-world severity beyond the CVSS 5.3 score. No public exploit identified as confirmed actively exploited (CISA KEV) at time of analysis, but the healthcare context and documented RCE chain make this a high-priority finding for any OpenClinic GA deployment.
Technical ContextAI
OpenClinic GA (CPE: cpe:2.3:a:frankverbeke:openclinic_ga:*:*:*:*:*:*:*:*) is an open-source hospital information and medical records management system implemented in Java. The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation - Reflected XSS): DICOM metadata fields, specifically Study Description among others, are ingested during the 'Upload DICOM images' feature workflow and subsequently rendered back to the user in popup.jsp and archiving/uploadfiles_jsp.java without output encoding or HTML sanitization. DICOM (Digital Imaging and Communications in Medicine) files carry rich, free-text metadata fields that are fully attacker-controlled when a crafted file is submitted. Because this is reflected (not stored) XSS, the payload executes in the browser of whichever authenticated user processes or views the upload result - a role typically held by radiologists, imaging technicians, or administrative staff with elevated application privileges.
RemediationAI
No vendor-released patch has been identified at time of analysis - no fixed version is cited in any of the available references, and the CPE wildcard suggests no upstream release has bounded the affected range. The primary compensating control is to disable or restrict access to the 'Upload DICOM images' feature (the specific application function where the vulnerability is triggered) until a patch is available; disabling this feature eliminates the attack surface entirely but will disrupt clinical imaging workflows. If disabling is operationally infeasible, restrict access to the DICOM upload endpoint (popup.jsp and the archiving/uploadfiles_jsp.java handler) to authenticated, trusted internal network segments only, and enforce strict network-layer access controls to prevent unauthenticated external upload requests - this does not eliminate the XSS but raises the bar for attacker access. Organizations should monitor the OpenClinic GA project repository and VulnCheck advisory at https://www.vulncheck.com/advisories/openclinic-ga-reflected-xss-via-dicom-image-upload-handler for patch releases. Given the demonstrated XSS-to-RCE escalation chain, treat this as a critical-priority item despite the medium CVSS score.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today