CVE-2026-50003: DCMTK Path Traversal in C-GET Bit-Preserving Storage Mode
A DCMTK client using bit-preserving C-GET storage mode can be induced by a malicious or compromised server to write files outside the chosen output directory. The weakness is classified as CWE-22 (Path Traversal) and is scored 9.8 under CVSS 3.1 and 9.3 under CVSS 4.0 by the CNA. No confirmed exploitation appears in the sources consulted, and the record lists no affected or fixed versions.
Overview
CVE-2026-50003 affects the DCMTK toolkit when a client uses bit-preserving C-GET storage mode. According to the record, a malicious or compromised server can cause the client to write files outside the directory the operator selected for output. The record classifies the issue as CWE-22 (Path Traversal). Details are also summarized in the CISA ICS medical advisory and its CSAF file.
Impact
- Files may be written to locations outside the chosen output directory, including through relative and absolute paths.
- The record scores the issue 9.8 under CVSS 3.1 and 9.3 under CVSS 4.0, both provided by the CNA, which indicates high severity.
- The record does not describe the specific files, systems or data that could be affected in a real deployment.
Affected products and versions
The affected product is DCMTK. The record does not list affected version ranges or fixed versions in its structured fields. The DCMTK releases page is referenced, but this analysis does not confirm which release corrects the issue.
Exploitation status
The CISA Known Exploited Vulnerabilities catalog does not list this CVE in the record. No confirmed exploitation appears in the sources consulted. The EPSS probability in the record is 0.00664, which is a statistical estimate and not evidence of exploitation.
Remediation and mitigation
- Check the DCMTK releases page and the CISA advisory for the current guidance on updated builds.
- Until an updated version is confirmed, limit C-GET retrievals to trusted servers and restrict the client process so that its output directory has minimal write permissions outside the intended path.
- Review whether bit-preserving storage mode is required in your workflows and disable it where it is not needed.
Detection guidance
- Monitor for files created by DCMTK client processes outside their configured output directories.
- Log C-GET associations and the servers they contact, and review unexpected retrievals from unfamiliar hosts.
Limitations of the available information
The record provides no affected version list, no fixed version list, no vendor-specific exploit conditions and no confirmed exploitation data. The reference links were not reviewed for version-level details in this analysis, so the affected and fixed versions remain unknown.
Frequently asked questions
What is the weakness in CVE-2026-50003?
The record describes a path traversal weakness (CWE-22) in which a DCMTK client using bit-preserving C-GET storage mode can write files outside the selected output directory when a malicious or compromised server supplies crafted paths.
Is this CVE known to be exploited?
The record shows this CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.
Which versions are affected?
The record does not list affected or fixed versions, so the exact affected versions remain unknown from the available data.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.