CVE-2026-40509 in OpenEMR
Summary
by MITRE • 08/19/2026
OpenEMR before 8.3.0 contains a cross-site request forgery vulnerability in the DICOM viewer. The web_path GET parameter in the DICOM viewer page is embedded unsanitized as a URL without validation against expected path formats. An attacker can craft a URL that causes an authenticated user with Patients - Documents permissions to make authenticated requests to arbitrary OpenEMR endpoints, enabling forced logout and other state-changing actions.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/19/2026
The vulnerability identified in versions of OpenEMR prior to 8.3.0 represents a critical security flaw within the DICOM viewer module, specifically stemming from improper input validation regarding URL construction. This issue is classified as Cross-Site Request Forgery, or CSRF, which falls under CWE-352 in the Common Weakness Enumeration taxonomy. The core technical defect lies in how the web_path GET parameter is handled by the application server. When a user accesses the DICOM viewer page, this parameter is directly embedded into a URL structure without any sanitization or validation against expected path formats. This lack of rigorous input checking allows an attacker to inject arbitrary paths that deviate from standard operational expectations, effectively bypassing internal safeguards designed to restrict navigation and action scopes within the application.
From an operational perspective, the impact of this vulnerability is significant for environments where patient data integrity and confidentiality are paramount. Because OpenEMR handles sensitive medical records via DICOM images, any unauthorized state change can compromise clinical workflows or lead to data exposure. An attacker who successfully exploits this flaw can craft a malicious URL that tricks an authenticated user possessing Patients - Documents permissions into making unintended requests to arbitrary endpoints within the OpenEMR system. This capability enables forced logout scenarios, which disrupts ongoing medical procedures and audits, as well as other state-changing actions that could alter patient records or configuration settings without explicit consent from the legitimate user. The attack vector relies on social engineering tactics where the victim is lured into visiting a crafted link while logged in, leveraging their existing authentication session to execute malicious commands.
This vulnerability aligns with MITRE ATT&CK technique T1566.002, which involves Spearphishing Link attacks under the Initial Access and Execution tactics. The attacker does not need to compromise credentials directly but instead abuses the trust relationship between the browser and the web application. By manipulating the DICOM viewer's URL parameter, the adversary can force the user's browser to send authenticated requests to endpoints that modify system state or access restricted resources. This is particularly dangerous in healthcare settings where continuity of care depends on stable session management and accurate record keeping. The ability to trigger forced logouts can be used as a distraction technique while other malicious activities are performed, or simply as a denial-of-service vector against specific users.
To mitigate this vulnerability, organizations running OpenEMR must upgrade immediately to version 8.3.0 or later, where the issue has been addressed through improved input validation and output encoding practices. In addition to upgrading, administrators should implement strict Content Security Policy headers that restrict allowed origins for form submissions and AJAX requests. Enabling anti-CSRF tokens on all state-changing operations is also critical to ensure that each request originates from a legitimate user interaction rather than a forged external source. Furthermore, reviewing the DICOM viewer module's codebase to enforce whitelist-based validation for URL parameters can prevent similar injection flaws in future updates. Regular security audits and penetration testing focusing on web application logic are recommended to identify and remediate such trust boundary violations before they can be exploited by malicious actors targeting healthcare infrastructure.