Loading vulnerability…
Path Traversal in DCMTK Bit-Preserving C-GET Client
CVE-2026-50003 is a critical path traversal vulnerability in OFFIS DCMTK affecting clients that use bit-preserving C-GET storage mode, including configurations such as getscu --bit-preserving or DCMSCU_STORAGE_BIT_PRESERVING. A malicious or compromised DICOM server can supply file paths that are not properly constrained to the client-selected output directory, allowing use of both relative traversal sequences such as ../ and absolute paths. As a result, the DCMTK client may create or truncate files outside the intended destination directory during C-GET storage handling.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows a remote malicious or compromised DICOM server to cause arbitrary file creation or truncation on the client system outside the configured output directory. This can compromise integrity by overwriting files, availability by damaging application or system files, and potentially confidentiality depending on what files are affected and how the written files are later processed. The vulnerability is rated Critical (CVSS v3.1 9.8; CVSS v4.0 9.3).
If you can’t patch tonight, do this now.
Until patched, avoid using bit-preserving C-GET storage mode with untrusted or non-fully-trusted DICOM servers. Keep DICOM services on trusted networks only, minimize network exposure, and isolate medical imaging/control networks from untrusted networks. Where possible, enforce strict path validation and output-directory restrictions in deployments or wrappers around DCMTK clients so server-supplied filenames cannot escape the intended directory.
Patch, then assume compromise.
Apply the upstream fix for CVE-2026-50003, identified in commit eca9a03dd, or upgrade to a DCMTK release that includes that fix. The issue affects OFFIS DCMTK versions prior to 3.7.0 / 3.7.0 and earlier according to the provided advisory context; use a vendor-supported build that incorporates the patch. Downstream consumers of DCMTK should obtain patched packages or updated products from their vendors where direct source-level patching is not practical.
No public exploits tracked yet. Mallory keeps watching.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.