CVE-2026-50003: OFFIS DCMTK Toolkit Path Traversal

Synopsis

A path traversal vulnerability in the OFFIS DCMTK Toolkit (versions up to and including 3.7.0) allows a malicious or compromised DICOM server to direct a connecting client to write files outside its intended output directory. The attack is reachable over the network with no authentication required, as derived from the CVSS v4.0 vector (AV:N, PR:N). Successful exploitation gives an attacker arbitrary file write on the client host, enabling data tampering and potential code execution by overwriting trusted files. No fix has been published yet; HarborGuard tracks the advisory and will surface a patched-image rebuild the moment upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must operate a reachable DICOM server over the network that the DCMTK client connects to, as indicated by AV:N in the CVSS vector.

• AuthenticationNot required

  No credentials or account privileges are needed to exploit this vulnerability; PR:N indicates the attack proceeds without any authentication barrier.

• Victim interactionNot required

  No user interaction is required beyond the DCMTK client's normal operation of connecting to a DICOM server, as indicated by UI:N.

• Attack complexityDetail

  Attack complexity is low (AC:L), meaning the exploit is reliable and requires no special timing, race conditions, or environmental preconditions beyond a client connecting to the attacker-controlled server.

Blast Radius

• Writes arbitrary files to any path on the client host filesystem, including outside the designated output directory, by supplying relative (../) or absolute paths in server responses.
• Overwrites existing files such as configuration files, executables, or scripts, enabling follow-on code execution on the affected host.
• Corrupts or replaces medical imaging data stored on the client system, directly affecting data integrity in DICOM workflows.