CVE-2026-40509

MediumCVSS 4.3

Published: 19/08/2026(UTC)Translated: 19/08/2026(UTC)NVD NIST

Summary

OpenEMR before 8.3.0 contains a cross-site request forgery vulnerability in the DICOM viewer. The web_path GET parameter is embedded as a URL without validation against expected path formats. An attacker can craft a URL that causes an authenticated user with Patients - Documents permissions to make authenticated requests to arbitrary OpenEMR endpoints, enabling forced logout and other state-changing actions.

Risk Assessment

CSRF attacks can lead to unauthorized actions in the system, such as forced logout or data modification, potentially compromising system integrity.

Recommendation

Update OpenEMR to version 8.3.0 or later, which includes a fix for this vulnerability.

Original NVD description (English source)

OpenEMR before 8.3.0 contains a cross-site request forgery vulnerability in the DICOM viewer. The web_path GET parameter in the DICOM viewer page is embedded unsanitized as a URL without validation against expected path formats. An attacker can craft a URL that causes an authenticated user with Patients - Documents permissions to make authenticated requests to arbitrary OpenEMR endpoints, enabling forced logout and other state-changing actions.