CVE-2023-7238: Orthanc-Server Osimis Web Viewer

Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days.

A XSS payload can be uploaded as a DICOM study and when a user tries to view the infected study inside the Osimis WebViewer the XSS vulnerability gets triggered. If exploited, the attacker will be able to execute arbitrary JavaScript code inside the victim's browser.

Affected products

Published 2024-01-23. Last modified 2026-06-17.