Description

OpenEMR before 8.3.0 contains a cross-site request forgery vulnerability in the DICOM viewer. The web_path GET parameter in the DICOM viewer page is embedded unsanitized as a URL without validation against expected path formats. An attacker can craft a URL that causes an authenticated user with Patients - Documents permissions to make authenticated requests to arbitrary OpenEMR endpoints, enabling forced logout and other state-changing actions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-19T15:17:01.867Z",
  "pubdate": "2026-08-19T15:17:01.867Z",
  "executiveSummary": "OpenEMR before 8.3.0 suffers from a cross-site request forgery vulnerability localized within the DICOM viewer component. This security flaw enables a remote attacker to construct a malicious URL that, when accessed by an authenticated user possessing Patients - Documents permissions, forces the browser to issue unintended authenticated requests to arbitrary OpenEMR endpoints. The resulting impact includes forced session termination and the execution of arbitrary state-changing actions within the application context. The risk implications involve unauthorized administrative or patient-data modifications performed under the victim's session context without their explicit consent. Exploitation requires the targeted user to be authenticated and to interact with the attacker-supplied URL, leveraging the browser's automatic credential inclusion in cross-origin requests.",
  "technicalDetails": "The root cause of this vulnerability lies in the insecure handling of the web_path GET parameter within the DICOM viewer page. The application directly embeds the unsanitized web_path parameter as a URL destination without enforcing strict validation mechanisms against expected path formats or destination domains. Because the application fails to implement robust anti-CSRF tokens or SameSite cookie protections on the vulnerable endpoint, an attacker can leverage standard browser behaviors to induce unauthorized cross-site requests.\nThe attack flow proceeds as follows: An attacker crafts a malicious URL pointing to the OpenEMR DICOM viewer endpoint, supplying a manipulated web_path parameter designed to target a specific sensitive internal endpoint or trigger a state-changing action, such as a forced logout or data modification function. The attacker then delivers this payload to an authenticated victim via social engineering vectors, such as phishing or malicious web pages. When the victim's browser renders the resource or follows the link, it automatically transmits the session cookies associated with the OpenEMR instance. The server processes the request under the victim's security context, treating it as a legitimate action.\nThe vulnerable component is the DICOM viewer interface within OpenEMR. Affected versions include all deployments prior to version 8.3.0. Exploitation requires network exposure to the OpenEMR instance, an active user session, and specific privilege requirements restricted to users with Patients - Documents permissions. The payload behavior dictates the targeted state-changing action, resulting in post-exploitation impact that compromises application integrity, session availability, and operational continuity."
}