CVE-2026-25860 is a reflected cross-site scripting vulnerability in OpenClinic GA 5.351.19. It arises from improper neutralization of input in the DICOM image upload feature, where JavaScript payloads embedded in metadata fields like Study Description are reflected without sanitization in popup.jsp and archiving/uploadfiles_jsp.java. This allows an attacker to execute arbitrary JavaScript in the context of a victim's browser when the malicious DICOM file is processed and viewed. The vulnerability is remotely exploitable without authentication and requires user interaction (UI required). The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required beyond victim browsing, and low scope impact. No vendor advisory or patch information is currently available.

Successful exploitation allows an attacker to execute arbitrary JavaScript code in the victim's browser within the context of the vulnerable OpenClinic GA web application. This can lead to session hijacking, unauthorized actions performed on behalf of the user, or other client-side attacks. The impact is limited to the web application context and requires the victim to process a maliciously crafted DICOM file. There is no indication of privilege escalation or server-side compromise from this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when uploading or processing DICOM files from untrusted sources. Implementing input validation and output encoding on DICOM metadata fields in the upload handler and related JSP pages is recommended once a patch or update is released.