CVE-2025-54862: Santesoft Sante PACS Server XSS Vulnerability

CVE-2025-54862 Overview

CVE-2025-54862 is a stored cross-site scripting (XSS) vulnerability in the Sante PACS Server web portal. An attacker can inject malicious HTML or JavaScript that persists in the application and executes in the browser of any user who views the affected page. Successful exploitation allows attackers to redirect users to attacker-controlled sites, steal session cookies, or perform actions on behalf of authenticated users.

The vulnerability is tracked as CWE-79: Improper Neutralization of Input During Web Page Generation. Because Sante PACS Server is used in healthcare imaging environments, exploitation can expose clinical workflows and sensitive medical data.

Critical Impact
Authenticated attackers can inject persistent HTML or JavaScript that executes in other users' browsers, enabling session hijacking, credential theft, and redirection to malicious sites within a healthcare imaging platform.

Affected Products

Santesoft Sante PACS Server (versions specified in CISA Medical Advisory ICSMA-25-224-01)
Sante PACS Server web portal component
Healthcare deployments relying on Sante PACS for DICOM image management

Discovery Timeline

2025-08-18 - CVE-2025-54862 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54862

Vulnerability Analysis

The Sante PACS Server web portal fails to properly neutralize user-supplied input before storing it and rendering it back to users. An authenticated attacker can submit HTML or JavaScript payloads through input fields that the application persists in its data store. When another user loads the affected page, the browser interprets the injected markup as legitimate content and executes any embedded script.

Stored XSS differs from reflected XSS because the payload remains active across sessions and affects every user who visits the injection point. In a Picture Archiving and Communication System (PACS) context, this means clinicians, administrators, and integration accounts can all be targeted by a single injection. Attackers can leverage this to steal session cookies, hijack authenticated sessions, or pivot to attack the underlying imaging workflows.

Root Cause

The root cause is insufficient input validation and output encoding in the web portal, classified as [CWE-79]. The application accepts input containing HTML control characters and script tags without sanitization or contextual encoding before writing it back into rendered pages.

Attack Vector

Exploitation requires network access to the web portal and low-privileged authenticated access. An attacker submits a crafted payload into a vulnerable input field. The payload is stored server-side and executes in the browser of any subsequent user, including higher-privileged administrators, who views the affected content. User interaction is required to trigger the stored payload.

No verified public proof-of-concept is available. Refer to the CISA Medical Advisory ICSMA-25-224-01 for vendor-specific technical details.

Detection Methods for CVE-2025-54862

Indicators of Compromise

Stored form fields, comments, or metadata containing <script>, onerror=, onload=, or javascript: sequences within the PACS database
Web server access logs showing POST requests with HTML-encoded or raw script payloads targeting portal endpoints
Outbound browser requests from clinician workstations to unfamiliar domains immediately after loading PACS portal pages
Unexpected session cookie transmissions to external hosts originating from authenticated PACS sessions

Detection Strategies

Deploy a web application firewall (WAF) with rules that flag HTML and JavaScript payloads submitted to Sante PACS portal endpoints
Review stored records in PACS metadata fields for HTML tags, event handlers, or encoded script content
Monitor Content Security Policy (CSP) violation reports if CSP headers are enabled on the portal
Correlate portal access logs with endpoint telemetry to identify anomalous browser redirects following PACS use

Monitoring Recommendations

Enable verbose access and application logging on the Sante PACS web portal and forward logs to a central SIEM
Alert on repeated authentication failures or session anomalies for accounts that recently accessed the portal
Track browser process behavior on workstations that access PACS for unexpected child processes or file downloads
Baseline outbound network traffic from clinical workstations to detect exfiltration attempts following XSS triggers

How to Mitigate CVE-2025-54862

Immediate Actions Required

Apply the vendor-supplied update referenced in CISA Medical Advisory ICSMA-25-224-01 as soon as it is validated in a test environment
Restrict network access to the Sante PACS web portal to trusted clinical VLANs and management workstations
Audit existing stored content in PACS metadata fields and remove any records containing HTML or script payloads
Rotate session cookies and credentials for portal users if suspicious stored content is identified

Patch Information

Santesoft has published remediation guidance through the CISA advisory. Consult the CISA Medical Advisory ICSMA-25-224-01 for the fixed version and vendor download instructions. Validate the patch in a non-production environment before deploying to clinical systems.

Workarounds

Place the Sante PACS web portal behind a WAF configured to strip or block HTML and JavaScript in submitted parameters
Enforce a strict Content Security Policy that disallows inline scripts and untrusted script sources at the reverse proxy layer
Limit web portal access to the minimum set of user accounts required for clinical operations
Require multi-factor authentication on all portal accounts to reduce the impact of session cookie theft

bash

# Example reverse-proxy hardening (nginx) to restrict portal exposure
location /pacs/ {
    allow 10.20.30.0/24;   # clinical workstation subnet
    deny all;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none'" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "DENY" always;
    proxy_pass http://sante-pacs-backend;
}