CVE-2026-40509: 
OpenEMR vulnerability analysis and mitigation

CVE-2026-40509 is a Cross-Site Request Forgery (CSRF) vulnerability in the DICOM viewer component of OpenEMR, an open-source electronic medical records platform. The flaw exists in /library/dicom_frame.php, where the web_path GET parameter is embedded unsanitized as a URL without validation, allowing an unauthenticated attacker to craft a malicious URL that forces an authenticated user to make unintended requests to arbitrary OpenEMR endpoints. All OpenEMR versions before 8.3.0 are affected. It was disclosed on August 19, 2026, with a patch released in OpenEMR 8.3.0 on August 18, 2026. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (Github Advisory, OpenEMR Advisory).

The root cause is CWE-352 (Cross-Site Request Forgery): the web_path parameter in library/dicom_frame.php is retrieved from $_REQUEST and only sanitized for quote characters via attr() before being embedded as a src attribute value in a Twig template (templates/dicom/dicom-viewer.html.twig). No CSRF token validation and no URL path restriction are applied when web_path is present, meaning any path — including internal OpenEMR endpoints — can be injected. The fix, applied in commit f760adc, adds a CsrfUtils::checkCsrfInput(INPUT_GET, dieOnFail: true) check that is triggered only when the web_path parameter is supplied, and updates callers to include a CSRF token in the constructed URL (OpenEMR Advisory, Fix Commit). The vulnerability also functions as an open redirect, enabling it to serve as a prerequisite for chained attacks against other OpenEMR endpoints (OpenEMR Advisory).

Successful exploitation allows an unauthenticated attacker to force an authenticated OpenEMR user with "Patients - Documents" permissions to make authenticated requests to arbitrary internal OpenEMR endpoints without their knowledge. Demonstrated impacts include forced session logout (via /interface/logout.php) and other state-changing actions performed in the victim's session context. While there is no direct confidentiality impact, the integrity of the OpenEMR session and application state can be compromised, and the vulnerability is noted as a prerequisite for chained attacks against additional endpoints (OpenEMR Advisory, Github Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (Github Advisory). The EPSS score is approximately 0.128% (3rd percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. The NVD SSVC assessment notes the attack is automatable with partial technical impact (Github Advisory).

1. Reconnaissance: Identify an internet-facing OpenEMR instance running a version prior to 8.3.0. Confirm the presence of the DICOM viewer by checking for /library/dicom_frame.php.
2. Identify target user: Determine or assume that a staff user with "Patients - Documents" permissions is actively authenticated to the OpenEMR instance.
3. Craft malicious URL: Construct a URL substituting an attacker-controlled or sensitive internal path for the web_path parameter. For example, to force logout: http://<target>/library/dicom_frame.php?web_path=/interface/logout.php?a=a
4. Deliver the URL: Send the crafted URL to the target user via phishing email, chat message, or embedded link in a document — any channel that causes the authenticated user's browser to navigate to or load the URL.
5. Trigger forced action: When the authenticated user's browser loads the URL, OpenEMR processes the web_path value without CSRF validation, causing the victim's browser to make an authenticated request to the injected endpoint (e.g., logging the user out or performing another state-changing action).
6. Chain further attacks: Substitute other sensitive OpenEMR endpoints for web_path to perform additional state-changing operations in the victim's session context (OpenEMR Advisory).

• Network: Unexpected HTTP GET requests to /library/dicom_frame.php with a web_path parameter pointing to non-DICOM paths (e.g., /interface/logout.php, other internal endpoints) in web server access logs.
• Logs: OpenEMR access logs showing requests to /library/dicom_frame.php?web_path=<internal_path> from user sessions, particularly where the referrer is an external or unexpected domain; sudden session terminations for users with Patients - Documents permissions.
• Application Behavior: Unexplained logouts or state changes for authenticated users with Patients - Documents permissions, especially if correlated with access to the DICOM viewer page.

Upgrade OpenEMR to version 8.3.0 or later, which adds CSRF token validation to the web_path parameter in library/dicom_frame.php (OpenEMR Release, Fix Commit). As a temporary workaround prior to patching, restrict access to the DICOM viewer functionality and educate users with Patients - Documents permissions to avoid clicking links from untrusted sources. Network-level controls such as restricting external access to the OpenEMR interface can reduce exposure (Github Advisory).