CVE-2025-54759: Sante PACS Server XSS Vulnerability

CVE-2025-54759 Overview

CVE-2025-54759 is a stored cross-site scripting (XSS) vulnerability in Sante PACS Server, a Picture Archiving and Communication System used in medical imaging environments. Attackers can inject malicious HTML or JavaScript payloads that are persistently stored by the server and later rendered in the browsers of authenticated users. Successful exploitation allows redirection to attacker-controlled webpages and theft of session cookies. The vulnerability is tracked under CWE-79 and was published to the National Vulnerability Database on August 18, 2025. Because Sante PACS Server operates in healthcare environments, cookie theft can expose access to sensitive patient imaging data.

Critical Impact
Attackers can hijack authenticated user sessions and redirect medical personnel to malicious sites, potentially exposing protected health information.

Affected Products

Santesoft Sante PACS Server
Deployments exposing the web interface to untrusted users
Healthcare imaging environments using vulnerable Sante PACS Server builds

Discovery Timeline

2025-08-18 - CVE-2025-54759 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54759

Vulnerability Analysis

The flaw is a stored cross-site scripting weakness in the Sante PACS Server web interface. The application accepts user-supplied input and stores it without sufficient output encoding or input sanitization. When another user views the affected page, the injected HTML or script executes in the context of that user's authenticated session. An attacker can craft payloads that read document.cookie, exfiltrate the value to an external server, or redirect the browser to a phishing page mimicking the PACS login. Because the payload is stored, exploitation persists across sessions and affects every user who visits the poisoned view. See the CISA Medical Advisory ICSMA-25-224-01 for vendor-coordinated details.

Root Cause

The root cause is improper neutralization of input during web page generation, classified as [CWE-79]. User-controlled fields are persisted to storage and later rendered directly into HTML responses without contextual encoding. The application does not enforce a Content Security Policy strong enough to block inline scripts or external redirects.

Attack Vector

Exploitation occurs over the network and requires user interaction, meaning a victim must view the page containing the stored payload. Authentication is not required to submit the malicious content in scenarios where injection endpoints are reachable without credentials. Once triggered, the script runs with the privileges of the viewing user's browser session against the PACS interface.

No verified public proof-of-concept is available for CVE-2025-54759. Refer to the vendor advisory for technical specifics.

Detection Methods for CVE-2025-54759

Indicators of Compromise

HTTP requests to Sante PACS Server endpoints containing HTML tags such as <script>, <img onerror=, or <iframe> in form fields.
Outbound browser connections from clinician workstations to unfamiliar domains immediately after loading PACS pages.
Unexpected Set-Cookie reads or document.cookie references appearing in browser console logs on PACS sessions.

Detection Strategies

Deploy a web application firewall rule set that inspects POST and GET parameters submitted to the PACS Server for XSS signatures.
Enable verbose application logging on Sante PACS Server and alert on stored fields containing angle brackets, javascript: URIs, or event handler attributes.
Perform periodic authenticated crawls of PACS content to identify persisted script content in rendered pages.

Monitoring Recommendations

Monitor egress traffic from workstations that access the PACS interface, focusing on connections to newly registered or low-reputation domains.
Correlate PACS session cookie usage across geographies or user agents to detect hijacked sessions.
Review web server access logs for repeated submissions to the same endpoints from a single source, indicating injection attempts.

How to Mitigate CVE-2025-54759

Immediate Actions Required

Apply the latest security update from Santesoft as referenced in the CISA Medical Advisory ICSMA-25-224-01.
Restrict network access to the Sante PACS Server web interface to trusted clinical VLANs and VPN users only.
Force reauthentication and invalidate active session cookies after patching to evict any hijacked sessions.

Patch Information

Santesoft has coordinated remediation guidance through CISA. Administrators should upgrade Sante PACS Server to the fixed release identified in the CISA Medical Advisory ICSMA-25-224-01 and confirm the deployed version no longer accepts unsanitized HTML input.

Workarounds

Place the PACS web interface behind a reverse proxy that strips or encodes HTML metacharacters in request parameters.
Enforce a strict Content Security Policy that disallows inline scripts and limits script sources to trusted origins.
Set the HttpOnly and Secure flags on session cookies to reduce the impact of cookie theft via script execution.

bash

# Example nginx reverse proxy hardening for the PACS interface
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; frame-ancestors 'none'" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
proxy_cookie_path / "/; HTTPOnly; Secure; SameSite=Strict";