CVE-2026-10173: Orthanc Explorer 2 URL StudyList.vue cross site scripting
A weakness has been identified in Orthanc Explorer 2 up to 1.12.0. The impacted element is an unknown function of the file WebApplication/src/components/StudyList.vue of the component URL Handler. This manipulation of the argument remote-source causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Patch name: 21f78ce5da668bf5233efcd1896ec7c6e3b22eae. Applying a patch is the recommended action to fix this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Orthanc Explorer 2to a version that resolves this vulnerability.Fixed in 1.12.0Patch 21f78ce5da668bf5233efcd1896ec7c6e3b22eae - Compensating control
Because the attack can be initiated remotely and involves Orthanc Explorer 2 URL Handler (WebApplication/src/components/StudyList.vue) remote-source input leading to cross-site scripting, restrict external/remote access to Orthanc Explorer 2 (e.g., allow access only from trusted IPs/VPN) until the patch is applied.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10173?
The severity of CVE-2026-10173 is medium with a CVSS score of 4.3.
What type of vulnerability is CVE-2026-10173?
CVE-2026-10173 is classified as a Cross Site Scripting (XSS) vulnerability within Orthanc Explorer 2.
How do I fix CVE-2026-10173?
To fix CVE-2026-10173, update Orthanc Explorer to the latest version that addresses this vulnerability.
Who is affected by CVE-2026-10173?
CVE-2026-10173 affects users of Orthanc Explorer versions up to 1.12.0.
What components are impacted by CVE-2026-10173?
CVE-2026-10173 specifically impacts the StudyList.vue file in the Orthanc Explorer's URL Handler component.