EUVD-2026-40422
GHSA-rmv2-5p78-8fvq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Malicious server triggers traversal during the client's C-GET with no auth or interaction beyond initiating retrieval; primitive is arbitrary file write, giving I:H and A:H with no direct confidentiality read.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
1DescriptionCVE.org
A malicious or compromised server can make a DCMTK client using bit-preserving C-GET storage mode write files outside the chosen output directory, using both relative (../) paths and absolute paths.
AnalysisAI
Path traversal in OFFIS DCMTK (DICOM Toolkit) lets a malicious or compromised DICOM server write attacker-controlled files to arbitrary locations on a DCMTK client host whenever that client retrieves objects using bit-preserving C-GET storage mode. Because the client trusts server-supplied storage paths, both relative (../) and absolute paths escape the chosen output directory, enabling overwrite of client-side files and potential code execution. Reported via CISA ICS-CERT (medical advisory ICSMA-26-181-01); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
DCMTK is the widely embedded OFFIS C++ implementation of the DICOM medical-imaging networking and file standard, used inside PACS, modalities, viewers, and gateways. The flaw is rooted in CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). During a DICOM C-GET operation in bit-preserving storage mode (where received datasets are written to disk byte-for-byte as delivered), the receiving client component derives output filenames from server-controlled metadata without canonicalizing or constraining them to the configured output directory, so embedded ../ sequences or absolute paths are honored. The affected CPE is cpe:2.3:a:offis_dicom:dcmtk_toolkit:*:*:*:*:*:*:*:*, indicating all versions prior to the fixed release are presumed affected pending vendor confirmation.
RemediationAI
Upgrade DCMTK to the fixed upstream release referenced at https://github.com/DCMTK/dcmtk/releases/tag/latest; the references point to a release tag rather than a specific semantic version, so the released patched version is not independently confirmed from the input - confirm the exact fixed version against the CISA advisory ICSMA-26-181-01 (https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-181-01) before deploying. As compensating controls until patched, avoid using bit-preserving C-GET storage mode (switch to normalized/standard storage handling that re-derives safe filenames), since that mode is the specific trigger - the trade-off is losing exact byte-for-byte preservation needed for some forensic or archival workflows. Additionally, restrict DCMTK clients to retrieve only from explicitly trusted, authenticated DICOM peers and segment imaging networks so clients cannot be redirected to rogue servers; the trade-off is reduced interoperability with ad-hoc peers. Run the receiving process under a low-privilege account with a write-restricted output directory (e.g., mandatory access controls) to blunt path traversal impact, accepting added operational configuration overhead.
More in Dcmtk Toolkit
View allPath traversal in OFFIS DCMTK DICOM toolkit lets an unauthenticated network attacker read DICOM Modality Worklist record
Denial of service in OFFIS DCMTK's DICOM worklist server (wlmscpfs) allows a remote, unauthenticated attacker to crash t
Denial of service in OFFIS DCMTK's storescp DICOM receiver allows an unauthenticated remote attacker to exhaust process
Denial of service in OFFIS DCMTK DICOM toolkit allows an unauthenticated remote attacker to exhaust memory by repeatedly
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allVendor StatusVendor
SUSE
Severity: CriticalShare
External POC / Exploit Code
Leaving vuln.today