CVE-2026-40509: OpenEMR < 8.3.0 CSRF via DICOM Viewer web_path Parameter
OpenEMR before 8.3.0 contains a cross-site request forgery vulnerability in the DICOM viewer. The webpath GET parameter in the DICOM viewer page is embedded unsanitized as a URL without validation against expected path formats. An attacker can craft a URL that causes an authenticated user with Patients - Documents permissions to make authenticated requests to arbitrary OpenEMR endpoints, enabling forced logout and other state-changing actions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenEMRto a version that resolves this vulnerability.Fixed in 8.3.0 - Compensating control
If you cannot upgrade immediately, mitigate CSRF impact in the OpenEMR DICOM viewer by preventing cross-site requests (e.g., enforce CSRF protections at the application layer for DICOM viewer endpoints and restrict external/untrusted origins from accessing them).
Event History
Frequently Asked Questions
Which users are exposed to exploitation?
An attacker must induce an authenticated OpenEMR user who has Patients - Documents permissions to visit a crafted URL. Users without an authenticated session and the specified permission are not described as able to trigger the affected requests.
What does an attacker need to exploit this issue?
The attacker needs to craft a URL using the DICOM viewer's web_path GET parameter and persuade a targeted authenticated user to open it. No attacker authentication or pre-existing privileges are indicated.
What can an attacker do through the vulnerability?
The crafted URL can cause the victim's browser to make authenticated requests to arbitrary OpenEMR endpoints. The reported impacts include forced logout and other state-changing actions available through the victim's session.
Which versions need remediation?
OpenEMR versions before 8.3.0 are affected. Updating to version 8.3.0 or later addresses the reported vulnerable version range.