CVE-2026-40509
Received Received - Intake

Cross-Site Request Forgery in OpenEMR DICOM Viewer

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: VulnCheck

Description
OpenEMR before 8.3.0 contains a cross-site request forgery vulnerability in the DICOM viewer. The web_path GET parameter in the DICOM viewer page is embedded unsanitized as a URL without validation against expected path formats. An attacker can craft a URL that causes an authenticated user with Patients - Documents permissions to make authenticated requests to arbitrary OpenEMR endpoints, enabling forced logout and other state-changing actions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-40509
EUVD
EUVD-2026-62510

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openemr openemr to 8.3.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-40509 is a Cross-Site Request Forgery (CSRF) vulnerability in OpenEMR versions before 8.3.0. It exists in the DICOM viewer component where the web_path GET parameter is embedded unsanitized as a URL without validation. An attacker can craft a malicious URL that forces an authenticated user with Patients - Documents permissions to make authenticated requests to arbitrary OpenEMR endpoints, enabling actions like forced logout.

Detection Guidance

To detect this vulnerability, check if your OpenEMR instance is running a version prior to 8.3.0. Review the DICOM viewer page for unsanitized web_path parameter usage. Monitor network logs for suspicious GET requests to /library/dicom_frame.php with arbitrary paths.

Impact Analysis

This vulnerability allows an attacker to trick an authenticated user into performing unwanted actions, such as forced logout or other state-changing operations, by tricking them into clicking a malicious link. The impact is limited to actions the victim is authorized to perform, but it can disrupt workflows or force users to re-authenticate.

Compliance Impact

This vulnerability could potentially impact compliance by allowing unauthorized state changes or data exposure if exploited. For example, forced logout might disrupt access controls, and arbitrary requests could lead to unauthorized actions affecting patient data integrity. However, specific compliance impacts depend on the organization's implementation and response.

Mitigation Strategies

Upgrade OpenEMR to version 8.3.0 or later immediately. Apply the patch from the commit f760adc7bddaf9d118e1a0d40590e686783ed21b which adds CSRF token validation to sensitive endpoints including the DICOM viewer.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-40509. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart