CVE-2026-25860Disclosure

LOWCVSS 5.3 · MEDIUM

Exploit discussion active in current signal (2 latest mentions)

Immediate actions

Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

OpenClinic GA 5.351.19 contains a reflected cross-site scripting vulnerability in the DICOM image upload handler that allows attackers to execute arbitrary JavaScript in a victim's browser by embedding malicious payloads in DICOM file metadata fields. Attackers can craft a DICOM file with JavaScript payloads in metadata fields such as Study Description, which are reflected without sanitization in popup.jsp and archiving/uploadfiles_jsp.java when processed through the Upload DICOM images feature.

Back to dashboard

1.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-79

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Threat summary

Public PoC is present in monitored signal
4 mentions across 3 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 2 signals
Technical details provided in 4 signals
Disclosure: 2 classified signals
General: 2 classified signals
Peaked at 2 mentions on most recent observed day (2026-08-07)
4 total mentions across 3 days

Deep dive

Activity timeline4 mentions / 3d

Signal classification2 categories

Disclosure

250.0%

General

250.0%

Referenced assets1 URL

By indicator

https://www.partywave.site/show/research/cve-2026-25860-openclinic-ga-xss-to-rce

Classification over time

Date	Total	Labels

2026-06-22	1	Disclosure1
2026-06-23	1	Disclosure1
2026-08-07	2	General2

Full discourse4 posts

ɐpnH@AlAssaf_H45d
General
CVE-2026-25860 is a reflected XSS vulnerability in OpenClinic GA’s DICOM upload workflow. A crafted DICOM file can inject JavaScript through metadata fields such as StudyDescription, which are rendered without output encoding. When triggered in the browser of an authenticated user, the XSS can be chained with OpenClinic GA configuration functionality to modify image-processing command settings and trigger command execution through storePicture.jsp.
Post summary
The post describes a reflected XSS vulnerability in OpenClinic GA’s DICOM upload feature that can lead to command execution when viewed by an authenticated user.
130106350
844 followersView on X
XSS Payloads@XssPayloads91d
Disclosure
CVE-2026-25860 - OpenClinic GA Reflected XSS to RCE Nice chain, starting with a refelected XSS and leading to an RCE. By Partiwave. https://www.partywave.site/show/research/cve-2026-25860-openclinic-ga-xss-to-rce
Post summary
Partiwave has disclosed a new vulnerability chain for OpenClinic GA, where a reflected XSS can be leveraged to achieve remote code execution, supported by a research link.
030883.4K
55.5K followersView on X
/r/netsec@_r_netsec91d
Disclosure
CVE-2026-25860 turn XSS to RCE https://www.partywave.site/show/research/cve-2026-25860-openclinic-ga-xss-to-rce
Post summary
The post announces CVE-2026-25860, noting that an XSS flaw in OpenClinic GA can be escalated to RCE, and provides a link to research detailing the findings.
040721.4K
33.6K followersView on X
ɐpnH@AlAssaf_H45d
General
https://www.partywave.site/show/research/cve-2026-25860-openclinic-ga-xss-to-rce
Post summary
The link points to research on CVE-2026‑25860, an OpenClinic GA vulnerability that escalates an XSS flaw to RCE, but the text provides no explicit PoC, exploit details, or mitigation information.
0002189
844 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-25860

ɐpnH[verified]@AlAssaf_HGeneral

The post describes a reflected XSS vulnerability in OpenClinic GA’s DICOM upload feature that can lead to command execution when viewed by an authenticated user.

ɐpnH[verified]@AlAssaf_HGeneral

The link points to research on CVE-2026‑25860, an OpenClinic GA vulnerability that escalates an XSS flaw to RCE, but the text provides no explicit PoC, exploit details, or mitigation information.

XSS Payloads@XssPayloadsDisclosure

Partiwave has disclosed a new vulnerability chain for OpenClinic GA, where a reflected XSS can be leveraged to achieve remote code execution, supported by a research link.

/r/netsec@_r_netsecDisclosure

The post announces CVE-2026-25860, noting that an XSS flaw in OpenClinic GA can be escalated to RCE, and provides a link to research detailing the findings.