CVE-2026-50003

Deferred Deferred - Pending Action

DCMTK Client Path Traversal via C-GET Storage Mode

Publication date: 2026-06-30

Last updated on: 2026-07-01

Assigner: ICS-CERT

Description

A malicious or compromised server can make a DCMTK client using bit-preserving C-GET storage mode write files outside the chosen output directory, using both relative (../) paths and absolute paths.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-30

Last Modified

2026-07-01

Generated

2026-07-21

AI Q&A

2026-07-01

EPSS Evaluated

2026-07-19

NVD

CVE-2026-50003

EUVD

EUVD-2026-40422

Affected Vendors & Products

Vendor	Product	Version / Range
offis	dcmtk	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability occurs when a malicious or compromised server interacts with a DCMTK client that uses bit-preserving C-GET storage mode. The server can exploit this to make the client write files outside of the intended output directory by using relative paths (like ../) or absolute paths.

Impact Analysis

The impact of this vulnerability is that an attacker controlling or compromising a server can cause a DCMTK client to write files to arbitrary locations on the client's file system. This can lead to unauthorized file creation or overwriting, potentially resulting in data corruption, data loss, or unauthorized access to sensitive files.

Compliance Impact

The provided information does not explicitly address how CVE-2026-50003 affects compliance with common standards and regulations such as GDPR or HIPAA.

Mitigation Strategies

To mitigate this vulnerability, users are advised to download and apply the latest fixes provided in the most recent DCMTK GitHub release.

CISA recommends minimizing network exposure of vulnerable systems and isolating control system networks from untrusted networks.

Use secure remote access methods such as VPNs and implement recommended cybersecurity strategies for proactive defense.

Hi! I’m here to help you understand CVE-2026-50003. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70