# CVE-2026-50003: OFFIS DCMTK path traversal in C-GET storage mode

Source: https://junglewise.ai/threats/cve-2026-50003-offis-dcmtk-path-traversal-in-c-get-storage-mode  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-30. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-50003 · Severity: critical · CVSS 9.8 · Published 2026-06-30

OFFIS DCMTK is a widely used toolkit for processing and transmitting medical images in the DICOM format. A vulnerability has been identified where a malicious or compromised server can force a client to save files in unauthorized locations on its computer. This could allow an attacker to overwrite critical system files or plant malicious software, potentially leading to a full system takeover or data loss in healthcare environments.

Technologies: [OFFIS DCMTK Toolkit](https://junglewise.ai/threats/technologies/offis-dcmtk). Vendors: [OFFIS](https://junglewise.ai/threats/vendors/offis).

## Quick answers

**Is CVE-2026-50003 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50003 being exploited in the wild.

**How severe is CVE-2026-50003?** Critical severity, with a CVSS score of 9.8, published 30 June 2026.

**Which products and versions are affected?** OFFIS DCMTK Toolkit <= 3.7.0.

**Is there a fix for CVE-2026-50003?** A patch was published on 2026-06-25: Fix included in latest commits/snapshots on GitHub Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-50003 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-50003?** Check whether you run OFFIS DCMTK Toolkit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability (CWE-22) exists in the OFFIS DCMTK Toolkit when a client utilizes bit-preserving C-GET storage mode. The root cause is improper validation of file paths provided by a DICOM server during data transfer. An attacker controlling a malicious server can send crafted responses containing relative (../) or absolute paths, forcing the client to write files outside of the intended destination directory. This can be exploited remotely without authentication if a client connects to a compromised server, potentially resulting in arbitrary file creation or overwriting. A fix has been provided in the latest DCMTK source snapshots on GitHub.

## Affected products

- OFFIS DCMTK Toolkit <= 3.7.0

## Timeline

- 2026-06-25: patched: Fix included in latest commits/snapshots on GitHub
- 2026-06-30: advisory: CISA ICS Medical Advisory ICSMA-26-181-01 published
- 2026-06-30: disclosed: CVE-2026-50003 published to NVD

## References

- [https://github.com/DCMTK/dcmtk/releases/tag/latest](https://github.com/DCMTK/dcmtk/releases/tag/latest)
- [https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-181-01.json](https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-181-01.json)
- [https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-181-01](https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-181-01)

## Related threats

- [OFFIS DCMTK path traversal in worklist server](https://junglewise.ai/threats/cve-2026-52868-offis-dcmtk-path-traversal-in-worklist-server)
- [OFFIS DCMTK memory leak in connection request handling](https://junglewise.ai/threats/cve-2026-35505-offis-dcmtk-memory-leak-in-connection-request-handling)
- [OFFIS DCMTK type confusion in worklist server](https://junglewise.ai/threats/cve-2026-44628-offis-dcmtk-type-confusion-in-worklist-server)