Loading vulnerability…
Called AE Title path traversal in OFFIS DCMTK wlmscpfs
CVE-2026-52868 is a high-severity path traversal vulnerability in the OFFIS DCMTK Toolkit affecting wlmscpfs, the filesystem-backed DICOM worklist server. An unauthenticated remote client can supply a Called AE Title containing a short traversal sequence, causing wlmscpfs to resolve and access a directory outside the intended per-AE worklist storage area. A normal C-FIND worklist query can then return records from that unintended location. In multi-area deployments, this breaks the expected per-AE segregation model and can expose worklist data across departmental or clinic boundaries. The provided context also indicates the flaw may enable a constrained write outside the request-file directory when non-default request-file logging is configured with AE Title or Patient ID placeholders. The issue is classified as improper limitation of a pathname to a restricted directory.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows unauthorized disclosure of DICOM worklist records stored outside the target AE's assigned directory. In environments using per-AE separation to isolate departments, clinics, or other operational areas, this can result in cross-tenant or cross-department exposure of patient scheduling and workflow metadata. Based on the provided context, the vulnerability is remotely exploitable without authentication and may also permit a limited write outside the request-file directory under specific non-default logging configurations.
If you can’t patch tonight, do this now.
Until a patched build is deployed, keep DICOM worklist services such as wlmscpfs accessible only from trusted networks, minimize network exposure, and prevent direct internet access. Enforce network segmentation and firewalling around DICOM services. Restrict access to worklist storage locations and review per-AE directory mappings to reduce unintended data exposure. If non-default request-file logging is enabled, avoid configurations that incorporate AE Title or Patient ID placeholders in paths until patched. Additional defensive measures from the provided context include validating file path inputs and implementing proper access controls around worklist records and storage.
Patch, then assume compromise.
Upgrade to a fixed DCMTK release that includes the upstream correction for CVE-2026-52868 when such a release is available. The provided context states that the fix was committed upstream as commit e3878daf8 and that affected versions are OFFIS DCMTK 3.7.0 and earlier / versions prior to 3.7.0. If consuming DCMTK through a downstream product, obtain a vendor-provided update incorporating the upstream fix.
No public exploits tracked yet. Mallory keeps watching.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.