Vulnerability DatabaseCVE-2026-40509
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2026-40509
Published:August 19, 2026
Updated:September 24, 2026
OpenEMR before 8.3.0 contains a cross-site request forgery vulnerability in the DICOM viewer. The web_path GET parameter in the DICOM viewer page is embedded unsanitized as a URL without validation against expected path formats. An attacker can craft a URL that causes an authenticated user with Patients - Documents permissions to make authenticated requests to arbitrary OpenEMR endpoints, enabling forced logout and other state-changing actions.
Affected Packages
https://github.com/openemr/openemr.git (GITHUB):
Affected version(s) >=v2_7_2 <v8_3_0
Fix Suggestion:
Update to version v8_3_0
Related Resources (7)
https://www.vulncheck.com/advisories/openemr-csrf-via-dicom-viewer-web-path-parameter
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40509.json
https://nvd.nist.gov/vuln/detail/CVE-2026-40509
https://github.com/openemr/openemr/security/advisories/GHSA-wffp-pj5h-xqwp
https://github.com/openemr/openemr
https://github.com/openemr/openemr/commit/f760adc7bddaf9d118e1a0d40590e686783ed21b
https://github.com/openemr/openemr/releases/tag/v8_3_0
Do you need more information?
Contact Us
CVSS v4
Base Score:
5.3
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
PASSIVE
Vulnerable System Confidentiality
NONE
Vulnerable System Integrity
LOW
Vulnerable System Availability
NONE
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
4.3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
NONE
Integrity
LOW
Availability
NONE
Weakness Type (CWE)
Cross-Site Request Forgery (CSRF)
CWE-352
EPSS
Base Score:
0.13