partywavesec/cve-2026-25860CVE-2026-25860 POC git
If you want to chain this XSS with RCE you can read:
OpenClinic GA <= v5.351.19 (12/05/2026) contains a reflected cross-site scripting vulnerability in the DICOM image upload handler that allows attackers to execute arbitrary JavaScript in a victim's browser by embedding malicious payloads in DICOM file metadata fields. Attackers can craft a DICOM file with JavaScript payloads in metadata fields such as Study Description, which are reflected without sanitization in popup.jsp and archiving/uploadfiles.java when processed through the Upload DICOM images feature.
In the older version the filename was uploadfiles_jsp.java.
web/archiving/uploadfiles.jsp file handles .DICOM upload result render and shows some DICOM fields. They are reflected without further computation and sanitization leading to reflected XSS.
The vulnerable code occurs (short version) where the DICOM Tag is handled. In particular StudyDescription is our POC field in the next images:
while (itr.hasNext()) {
i++;
FileItem item = (FileItem) itr.next();
if (item.isFormField()) {
} else {
try {
String fn = SCANDIR_BASE + "/from/" + filename + "_" + i;
File savedFile = new File(fn);
InputStream is = item.getInputStream();
FileUtils.copyInputStreamToFile(is, savedFile);
is.close();
DicomObject obj = Dicom.getDicomObject(savedFile);
if (obj == null) {
errors.add(item.getName());
} else {
patients.add(obj.getString(Tag.PatientID));
studies.add(obj.getString(Tag.StudyID) + "</td><td>" + obj.getString(Tag.StudyDescription).replaceAll("\\^", " "));
}
} catch (Exception e) {
e.printStackTrace();
}
}
}
Note: the latest stable download ready-to-run release is some version behind the tested one. But the vulnerability is still present and works on both Linux and Windows
Create the malicious DICOM file file.dcm by modifying the StudyDescription with the html code to inject to execute javascript:
Further inspection and the popup management is handled by popup.js
Upload this file to trigger the reflected XSS:
