Critical severity9.8NVD Advisory· Published Jun 30, 2026· Updated Jul 1, 2026
CVE-2026-50003
CVE-2026-50003
Description
A malicious or compromised server can make a DCMTK client using bit-preserving C-GET storage mode write files outside the chosen output directory, using both relative (../) paths and absolute paths.
Affected products
1Patches
Vulnerability mechanics
References
3News mentions
2- DICOM Toolkit Bugs Raise Medical Imaging Security RisksGovInfoSecurity · Jun 30, 2026
- OFFIS DCMTK ToolkitCISA Alerts