DCMTK Client Path Traversal via C-GET Storage Mode

Publication date: 2026-06-30

Last updated on: 2026-06-30

Assigner: ICS-CERT

Description

A malicious or compromised server can make a DCMTK client using bit-preserving C-GET storage mode write files outside the chosen output directory, using both relative (../) paths and absolute paths.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-30

Last Modified

2026-06-30

Generated

2026-07-01

AI Q&A

2026-07-01

EPSS Evaluated

N/A

NVD

CVE-2026-50003

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability occurs when a malicious or compromised server interacts with a DCMTK client that uses bit-preserving C-GET storage mode. The server can exploit this to make the client write files outside of the intended output directory by using relative paths (like ../) or absolute paths.

Impact Analysis

The impact of this vulnerability is that an attacker controlling or compromising a server can cause a DCMTK client to write files to arbitrary locations on the client's file system. This can lead to unauthorized file creation or overwriting, potentially resulting in data corruption, data loss, or unauthorized access to sensitive files.

Hi! I’m here to help you understand CVE-2026-50003. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70