CVE-2026-25860 describes a reflected cross-site scripting vulnerability in OpenClinic GA version 5.351.19. The issue arises because the DICOM image upload handler processes metadata fields from DICOM files, such as Study Description, without proper input neutralization. These fields are reflected in popup.jsp and archiving/uploadfiles_jsp.java pages without sanitization, enabling attackers to inject and execute arbitrary JavaScript code in users' browsers. This vulnerability requires user interaction (UI:P) and has no privileges required (PR:N). The vendor has not provided any official fix or remediation level at this time.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser when viewing the affected pages that process DICOM metadata. This can lead to session hijacking, information disclosure, or other client-side attacks depending on the malicious payload. The vulnerability is medium severity (CVSS 5.3) and does not require authentication or privileges to exploit. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when uploading or processing untrusted DICOM files. Implementing input sanitization or filtering on DICOM metadata fields before rendering them in web pages is recommended if possible. Monitor vendor channels for updates or official patches.