CVE-2026-10173 Details
Description
A weakness has been identified in Orthanc Explorer 2 up to 1.12.0. The impacted element is an unknown function of the file WebApplication/src/components/StudyList.vue of the component URL Handler. This manipulation of the argument remote-source causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Patch name: 21f78ce5da668bf5233efcd1896ec7c6e3b22eae. Applying a patch is the recommended action to fix this issue.
A cross-site scripting (XSS) vulnerability has been identified in Orthanc Explorer versions 2.0.0 up to 1.12.0. The issue arises in the URL Handler component, specifically within the 'WebApplication/src/components/StudyList.vue' file. The vulnerability is triggered by the 'remote-source' URL query parameter, which is processed without proper sanitization. This unsanitized input is then injected into a Vue-i18n translation string and rendered as HTML, allowing an attacker to execute arbitrary JavaScript in the context of the user's browser session.
Users are advised to update to Orthanc Explorer version 1.12.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 31, 2026CISA-ADP
Assessed Jun 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/orthanc-server/orthanc-explorer-2/issues/108 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/rafaelsouzars/orthanc-explorer-2/commit/21f78ce5da668bf5233efcd1896ec7c6e3b22eae | [email protected] | Source CodeVendor |
| https://vuldb.com/cve/CVE-2026-10173 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/819559 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/367430 | [email protected] | BundlePermission Required |
| https://vuldb.com/vuln/367430/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Orthanc Explorer | <= 1.12.0 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 31, 2026 | New CVE Received | [email protected] |