Sante Pacs Server CVE-2025-2264
HIGHCVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
3DescriptionNVD
A Path Traversal Information Disclosure vulnerability exists in "Sante PACS Server.exe". An unauthenticated remote attacker can exploit it to download arbitrary files on the disk drive where the application is installed.
AnalysisAI
Sante PACS Server contains an unauthenticated path traversal vulnerability that allows remote attackers to download arbitrary files from the server's installation drive. Medical imaging servers typically contain DICOM files with protected health information (PHI), making this a significant healthcare data breach vector.
Technical ContextAI
The web interface of Sante PACS Server.exe improperly handles URL-encoded path traversal sequences. An unauthenticated attacker can send crafted HTTP requests with ../ sequences to read any file on the drive where the application is installed. PACS (Picture Archiving and Communication System) servers store DICOM medical images that contain embedded patient data.
RemediationAI
Update Sante PACS Server to a patched version. Never expose PACS servers directly to the internet. Implement network segmentation for medical imaging infrastructure. Deploy a reverse proxy with path traversal filtering. Conduct a PHI breach assessment if exploitation is suspected.
Share
External POC / Exploit Code
Leaving vuln.today