Skip to main content

DCMTK toolkit CVE-2026-50003

| EUVDEUVD-2026-40422 CRITICAL
Path Traversal (CWE-22)
2026-06-30 icscert GHSA-rmv2-5p78-8fvq
Path Traversal Dcmtk Toolkit
9.3
CVSS 4.0 · Vendor: icscert
Share

Severity by source

Vendor (icscert) PRIMARY
9.3 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.1 CRITICAL

Malicious server triggers traversal during the client's C-GET with no auth or interaction beyond initiating retrieval; primitive is arbitrary file write, giving I:H and A:H with no direct confidentiality read.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (icscert).

CVSS VectorVendor: icscert

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

1
Analysis Generated
Jun 30, 2026 - 22:04 vuln.today

DescriptionCVE.org

A malicious or compromised server can make a DCMTK client using bit-preserving C-GET storage mode write files outside the chosen output directory, using both relative (../) paths and absolute paths.

AnalysisAI

Path traversal in OFFIS DCMTK (DICOM Toolkit) lets a malicious or compromised DICOM server write attacker-controlled files to arbitrary locations on a DCMTK client host whenever that client retrieves objects using bit-preserving C-GET storage mode. Because the client trusts server-supplied storage paths, both relative (../) and absolute paths escape the chosen output directory, enabling overwrite of client-side files and potential code execution. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Attacker controls malicious DICOM server
Delivery
Victim DCMTK client initiates bit-preserving C-GET
Exploit
Server returns object with ../ or absolute path
Execution
Client writes file outside output directory
Persist
Overwrite startup/config file
Impact
Achieve persistence or code execution on client host
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the victim DCMTK client (a) initiate a C-GET retrieval and (b) be operating in bit-preserving storage mode - that storage mode is the exact feature that disables safe filename normalization and is the named precondition. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The supplied CVSS 4.0 base score is 9.3 (Critical) with vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, indicating network reachability, low complexity, no privileges and no user interaction, with high impact to confidentiality, integrity and availability of the vulnerable client. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker stands up or compromises a DICOM server (C-STORE SCP) that a hospital's DCMTK-based client queries using bit-preserving C-GET. When the client retrieves images, the malicious server returns objects whose storage paths contain ../ sequences or absolute paths, causing the client to write attacker-supplied files such as a cron job, startup script, or config file outside the intended directory. …
Remediation Upgrade DCMTK to the fixed upstream release referenced at https://github.com/DCMTK/dcmtk/releases/tag/latest; the references point to a release tag rather than a specific semantic version, so the released patched version is not independently confirmed from the input - confirm the exact fixed version against the CISA advisory ICSMA-26-181-01 (https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-181-01) before deploying. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Inventory all systems running OFFIS DCMTK with C-GET functionality; restrict network access to DICOM servers from an approved whitelist only. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Dcmtk Toolkit

View all
CVE-2026-52868 HIGH
8.8 Jun 30

Path traversal in OFFIS DCMTK DICOM toolkit lets an unauthenticated network attacker read DICOM Modality Worklist record
CVE-2026-44628 HIGH
8.7 Jun 30

Denial of service in OFFIS DCMTK's DICOM worklist server (wlmscpfs) allows a remote, unauthenticated attacker to crash t
CVE-2026-50254 HIGH
8.7 Jun 30

Denial of service in OFFIS DCMTK's storescp DICOM receiver allows an unauthenticated remote attacker to exhaust process

CVE-2026-35505 HIGH
8.7 Jun 30

Denial of service in OFFIS DCMTK DICOM toolkit allows an unauthenticated remote attacker to exhaust memory by repeatedly

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0
CVE-2018-13379 CRITICAL POC
9.1
CVE-2024-57727 HIGH POC
7.5

Same technique Path Traversal

View all
CVE-2025-64446 CRITICAL POC
9.8
CVE-2024-13159 CRITICAL POC
9.8
CVE-2024-13160 CRITICAL POC
9.8
CVE-2024-13161 CRITICAL POC
9.8
CVE-2024-48248 HIGH POC
8.6
CVE-2024-57727 HIGH POC
7.5
CVE-2024-7399 HIGH POC
8.8
CVE-2024-27199 HIGH POC
7.3

Share

CVE-2026-50003 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy