// CVE · PUBLISHED 2026-06-30
CVE-2026-50003 OFFIS DICOM / DCMTK Toolkit
9.3 · CVSS 4.0 Critical
Description A malicious or compromised server can make a DCMTK client using bit-preserving C-GET storage mode write files outside the chosen output directory, using both relative (../) paths and absolute paths.
← CVE Index: search every CVE from the last 30 days
This product uses the NVD API but is not endorsed or certified by the NVD. CVSS scores do not establish exploitation.
Details Products OFFIS DICOM / DCMTK Toolkit Published 30 Jun 2026 Modified 25 Oct 2026 CVSS 9.3 Critical (v4.0) Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Score source ics-cert@hq.dhs.gov CWE CWE-22 Record status Deferred