Executive brief
OFFIS DCMTK is a widely used toolkit for processing and transmitting medical images in the DICOM format. A vulnerability has been identified where a malicious or compromised server can force a client to save files in unauthorized locations on its computer. This could allow an attacker to overwrite critical system files or plant malicious software, potentially leading to a full system takeover or data loss in healthcare environments.
Technical details
A path traversal vulnerability (CWE-22) exists in the OFFIS DCMTK Toolkit when a client utilizes bit-preserving C-GET storage mode. The root cause is improper validation of file paths provided by a DICOM server during data transfer. An attacker controlling a malicious server can send crafted responses containing relative (../) or absolute paths, forcing the client to write files outside of the intended destination directory. This can be exploited remotely without authentication if a client connects to a compromised server, potentially resulting in arbitrary file creation or overwriting. A fix has been provided in the latest DCMTK source snapshots on GitHub.
Affected products
- OFFIS DCMTK Toolkit <= 3.7.0
Timeline
- 2026-06-25: patched: Fix included in latest commits/snapshots on GitHub
- 2026-06-30: advisory: CISA ICS Medical Advisory ICSMA-26-181-01 published
- 2026-06-30: disclosed: CVE-2026-50003 published to NVD