CVE-2025-58090 identifies a reflected cross-site scripting (XSS) vulnerability in MedDream PACS Premium version 7.3.6.870, a medical imaging software widely used for managing and viewing medical images. The vulnerability resides in the config.php functionality, specifically in the 'uploaddir' parameter, which fails to properly neutralize user-supplied input before reflecting it in the web page output. An attacker can craft a specially designed URL containing malicious JavaScript code embedded in the 'uploaddir' parameter. When a user clicks this URL, the malicious script executes within the victim's browser context, potentially allowing the attacker to steal session cookies, perform actions on behalf of the user, or redirect the user to malicious websites. This reflected XSS does not require the attacker to have any privileges or authentication, but it does require the victim to interact with the malicious link. The vulnerability affects confidentiality and integrity by enabling unauthorized script execution but does not impact availability. The CVSS 3.1 base score is 6.1, indicating medium severity, with attack vector as network, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity. No public exploits are known at this time, but the vulnerability is published and should be addressed promptly. The lack of vendor patches currently necessitates interim mitigations such as input validation and access restrictions.

For European organizations, particularly healthcare providers using MedDream PACS Premium 7.3.6.870, this vulnerability poses a risk of client-side script injection leading to session hijacking, unauthorized actions, or phishing attacks targeting medical staff. Compromise of user sessions could lead to unauthorized access to sensitive patient data or manipulation of medical imaging workflows, undermining data confidentiality and integrity. Although the vulnerability does not directly affect system availability, successful exploitation could facilitate further attacks or data breaches. Given the critical nature of healthcare data and regulatory requirements such as GDPR, exploitation could result in significant legal and reputational consequences. The requirement for user interaction limits automated exploitation but does not eliminate risk, especially in environments where users may be targeted via phishing or malicious links. The vulnerability's presence in a widely used PACS product increases the attack surface within European healthcare institutions, which are often targeted by cyber adversaries due to the sensitivity of their data.

Organizations should immediately review access controls to the MedDream PACS configuration interface, restricting it to trusted internal networks and authenticated users only. Implement web application firewall (WAF) rules to detect and block malicious payloads targeting the 'uploaddir' parameter. Until an official patch is released, apply input validation and output encoding on all user-supplied inputs in the config.php functionality to neutralize potentially malicious scripts. Educate users about the risks of clicking unsolicited or suspicious links, especially those purporting to relate to medical imaging systems. Monitor logs for unusual URL requests containing suspicious parameters. Coordinate with MedDream for timely patch deployment once available. Additionally, consider deploying Content Security Policy (CSP) headers to limit the execution of unauthorized scripts within the PACS web interface. Regularly audit and update software versions to minimize exposure to known vulnerabilities.