# CVE-2026-52868: OFFIS DCMTK path traversal in worklist server

Source: https://junglewise.ai/threats/cve-2026-52868-offis-dcmtk-path-traversal-in-worklist-server  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-30. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-52868 · Severity: high · CVSS 8.2 · Published 2026-06-30

OFFIS DCMTK is a widely used toolkit for processing and transmitting medical images and data in healthcare environments. A security flaw allows an unauthorized person to bypass data separation controls and access medical worklist records they should not be able to see. In a hospital or clinic setting, this could lead to the exposure of sensitive patient information across different departments.

Technologies: [OFFIS DCMTK Toolkit](https://junglewise.ai/threats/technologies/offis-dcmtk). Vendors: [OFFIS](https://junglewise.ai/threats/vendors/offis).

## Quick answers

**Is CVE-2026-52868 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-52868 being exploited in the wild.

**How severe is CVE-2026-52868?** High severity, with a CVSS score of 8.2, published 30 June 2026.

**Which products and versions are affected?** OFFIS DCMTK Toolkit <= 3.7.0.

**Is there a fix for CVE-2026-52868?** A patch was published on 2026-06-25: Fix included in latest repository commits/snapshots Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-52868 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-52868?** Check whether you run OFFIS DCMTK Toolkit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability (CWE-22) exists in the worklist server component of the OFFIS DCMTK toolkit. An unauthenticated remote attacker can exploit this by submitting crafted requests to access worklist records stored in directories outside the intended per-Application Entity (AE) storage area. In multi-tenant or multi-departmental deployments, this allows for the unauthorized retrieval of sensitive DICOM worklist data across administrative boundaries. The vulnerability affects versions up to and including 3.7.0; a fix has been committed to the project's main repository.

## Affected products

- OFFIS DCMTK Toolkit <= 3.7.0

## Timeline

- 2026-06-25: patched: Fix included in latest repository commits/snapshots
- 2026-06-30: advisory: CISA ICS Medical Advisory ICSMA-26-181-01 published
- 2026-06-30: disclosed

## References

- [https://github.com/DCMTK/dcmtk/releases/tag/latest](https://github.com/DCMTK/dcmtk/releases/tag/latest)
- [https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-181-01.json](https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-181-01.json)
- [https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-181-01](https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-181-01)

## Related threats

- [OFFIS DCMTK path traversal in C-GET storage mode](https://junglewise.ai/threats/cve-2026-50003-offis-dcmtk-path-traversal-in-c-get-storage-mode)
- [OFFIS DCMTK memory leak in connection request handling](https://junglewise.ai/threats/cve-2026-35505-offis-dcmtk-memory-leak-in-connection-request-handling)
- [OFFIS DCMTK type confusion in worklist server](https://junglewise.ai/threats/cve-2026-44628-offis-dcmtk-type-confusion-in-worklist-server)