CVE-2026-40509: 
OpenEMR vulnerability analysis and mitigation

CVE-2026-40509 is a Cross-Site Request Forgery (CSRF) vulnerability in the DICOM viewer component of OpenEMR, an open-source electronic medical records platform. The flaw exists in /library/dicom_frame.php, where the web_path GET parameter is embedded unsanitized as a URL without validation against expected path formats. All OpenEMR versions before 8.3.0 are affected. The vulnerability was published on August 19, 2026, with a patch available in OpenEMR 8.3.0 released August 18, 2026. It carries a CVSS v3.1 base score of 4.3 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (OpenEMR Advisory, Github Advisory).

The root cause is CWE-352 (Cross-Site Request Forgery): the web_path parameter retrieved via $_REQUEST['web_path'] in library/dicom_frame.php is only sanitized for quote characters using attr() before being embedded as a src attribute value in a Twig template (templates/dicom/dicom-viewer.html.twig). No URL validation or path restriction is applied, allowing an attacker to supply an arbitrary path — including internal OpenEMR endpoints — that the victim's browser will navigate to or load in an authenticated context. The fix (commit f760adc) adds a CsrfUtils::checkCsrfInput(INPUT_GET, dieOnFail: true) check when web_path is present, and updates callers to include a CSRF token in the URL (OpenEMR Advisory, Fix Commit).

Successful exploitation allows an unauthenticated attacker to force an authenticated OpenEMR user with "Patients - Documents" permissions to make authenticated requests to arbitrary OpenEMR endpoints without their knowledge. Demonstrated impacts include forced session logout and other state-changing actions; the advisory notes this vulnerability also serves as a prerequisite for a chained attack (described as "Vulnerability 5" in the original research). There is no direct confidentiality impact, but integrity of user sessions and application state can be affected (OpenEMR Advisory, Github Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — a victim with "Patients - Documents" permissions must click a crafted link — limiting the attack surface compared to fully unauthenticated, no-interaction vulnerabilities (Github Advisory, Feedly).

1. Reconnaissance: Identify an internet-facing OpenEMR instance running a version prior to 8.3.0. Confirm the target has the DICOM viewer accessible at /library/dicom_frame.php.
2. Identify target user: Determine or assume that a staff member with "Patients - Documents" permissions (read/write/addonly) is an active user of the system.
3. Craft malicious URL: Construct a URL substituting an arbitrary OpenEMR endpoint for the web_path parameter, for example:

   http://<target>/library/dicom_frame.php?web_path=/interface/logout.php?a=a

   Any other authenticated state-changing endpoint can be substituted.
4. Deliver the URL: Send the crafted URL to the target user via phishing email, chat message, or embedded link in a document, enticing them to click it while authenticated to OpenEMR.
5. Trigger forced action: When the victim clicks the link, their browser loads the DICOM viewer page, which embeds the attacker-controlled web_path value as a src attribute. The victim's browser makes an authenticated request to the specified endpoint (e.g., logout), executing the state-changing action in the victim's session context without their knowledge (OpenEMR Advisory).

• Logs: OpenEMR access logs showing requests to /library/dicom_frame.php with a web_path parameter pointing to non-DICOM endpoints (e.g., /interface/logout.php, administrative pages, or other internal paths) rather than expected DICOM document URLs.
• Logs: Unexpected session termination events (logout) for users who did not initiate logout, correlating with access log entries for the DICOM viewer endpoint.
• Network: HTTP GET requests to /library/dicom_frame.php?web_path=<non-DICOM-path> originating from user browsers, particularly if the web_path value contains paths like /interface/, /admin/, or other application endpoints.

The primary remediation is to upgrade OpenEMR to version 8.3.0 or later, which incorporates CSRF token validation on the web_path parameter in library/dicom_frame.php. Until patching is possible, administrators should restrict access to the DICOM viewer functionality and advise users with "Patients - Documents" permissions to exercise caution when clicking links from untrusted sources. Network-level controls (e.g., restricting external access to the OpenEMR instance) can reduce exposure but do not eliminate the risk from insider or phishing-based delivery (OpenEMR Release, Fix Commit).