File Write Vulnerability in DCMTK Client by DCMTK
CVE-2026-50003
9.3CRITICAL
What is CVE-2026-50003?
A vulnerability exists in the DCMTK Client that allows an attacker to exploit the C-GET storage mode, enabling them to write files outside the designated output directory. This can happen through the use of both relative ('../') and absolute paths, potentially allowing unauthorized access to sensitive files. This poses a significant risk, particularly if the DCMTK client is interfacing with compromised servers.
Affected Version(s)
DCMTK Toolkit 0 <= 3.7.0
References
CVSS V4
Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Abhinav Agarwal reported this vulnerability to CISA.