PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-10173 Orthanc CVE debrief

A stored cross-site scripting (XSS) vulnerability exists in Orthanc Explorer 2 up to version 1.12.0. The flaw resides in the URL handler within `WebApplication/src/components/StudyList.vue`, where the `remote-source` argument is not properly sanitized before rendering. An attacker can inject malicious scripts through this parameter, which execute in the context of a victim's browser session when interacting with the study list interface. The attack vector is remote and requires user interaction, consistent with the LOW severity rating. A patch is available via commit `21f78ce5da668bf5233efcd1896ec7c6e3b22eae`.

Vendor
Orthanc
Product
Explorer 2
CVSS
LOW 2.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-31
Original CVE updated
2026-07-22
Advisory published
2026-05-31
Advisory updated
2026-07-22

Who should care

Healthcare organizations using Orthanc Explorer 2 for DICOM medical imaging management; security teams defending web-based medical imaging interfaces; developers maintaining Vue.js applications handling URL parameters.

Technical summary

The vulnerability is a cross-site scripting flaw in Orthanc Explorer 2 versions up to 1.12.0. The affected component is the URL handler in `WebApplication/src/components/StudyList.vue`. The `remote-source` argument is vulnerable to injection of malicious scripts. Successful exploitation requires remote attack initiation with user interaction. The exploit has been publicly disclosed. The fix is contained in commit 21f78ce5da668bf5233efcd1896ec7c6e3b22eae.

Defensive priority

medium

Recommended defensive actions

  • Apply the patch from commit 21f78ce5da668bf5233efcd1896ec7c6e3b22eae to remediate this vulnerability.
  • Upgrade to a fixed version of Orthanc Explorer 2 beyond 1.12.0 when available.
  • Implement Content Security Policy (CSP) headers to mitigate impact of any residual XSS vectors.
  • Validate and sanitize all user-controllable input, particularly URL parameters like remote-source, before DOM insertion.
  • Review WebApplication/src/components/StudyList.vue for additional unescaped output contexts.

Evidence notes

The vulnerability was reported to VulDB (submission 819559) and assigned CVE-2026-10173. The issue was tracked as GitHub issue #108 in the orthanc-server/orthanc-explorer-2 repository. The fix was committed by rafaelsouzars. CVSS 4.0 vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. CWE-79 (Improper Neutralization of Input During Web Page Generation) and CWE-94 (Improper Control of Generation of Code) are identified as associated weaknesses.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-10173 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-10173

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-10173 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-10173

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.