CVE-2025-0572: Sante PACS Server Path Traversal Vulnerability

CVE-2025-0572 Overview

CVE-2025-0572 is a directory traversal vulnerability in the Sante PACS Server Web Portal. The flaw exists in the parsing of DICOM (.DCM) files, where user-supplied paths are used in file operations without proper validation [CWE-22]. Authenticated remote attackers can leverage this issue to write arbitrary files in the context of the running service account. The vulnerability was reported through the Trend Micro Zero Day Initiative as ZDI-CAN-25308 and disclosed publicly as ZDI-25-054.

Critical Impact
Authenticated attackers can write arbitrary files to the file system of a Sante PACS Server host, enabling tampering with medical imaging data or planting of files that support follow-on attacks.

Affected Products

Santesoft Sante PACS Server (Web Portal component)
Deployments exposing the DCM file parsing endpoint to authenticated users
Healthcare environments using Sante PACS Server for DICOM image storage

Discovery Timeline

2025-01-30 - CVE-2025-0572 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0572

Vulnerability Analysis

The vulnerability resides in the Web Portal component of Sante PACS Server, specifically in the code path that parses uploaded DICOM (.DCM) files. Picture Archiving and Communication System (PACS) servers accept DICOM objects from imaging modalities and clients, then persist them to disk using metadata contained in the file. In vulnerable versions, the server derives an output file path from attacker-controlled fields inside the DCM without normalizing or constraining that path to the intended storage directory.

An authenticated attacker can craft a DCM file whose embedded path fields contain directory traversal sequences such as ..\ or ../. When the server processes the upload, it writes the resulting file to a location outside of the PACS storage root. The write occurs with the privileges of the Sante PACS Server process, which in typical installations has broad access to the host file system.

Exploitation requires valid credentials to the Web Portal but no user interaction. Impact is limited to integrity of files on the host; the flaw does not directly expose confidential data or crash the service, which aligns with the vector components describing integrity impact only.

Root Cause

The root cause is missing canonicalization and validation of user-supplied path data extracted from DCM files before it is passed to file write operations. This is a textbook path traversal weakness classified under [CWE-22]: Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

The attack is delivered over the network through the Web Portal upload interface. The attacker authenticates, submits a malicious DCM file containing traversal sequences in a path-bearing field, and the server writes the file contents to an arbitrary location on disk. See the Zero Day Initiative Advisory ZDI-25-054 for the coordinated disclosure details.

No verified public proof-of-concept code is available. The vulnerability manifests during DCM parsing when the server concatenates untrusted path components with a base directory and calls the underlying file write API without validating that the resolved path stays within the intended storage root.

Detection Methods for CVE-2025-0572

Indicators of Compromise

DCM files or unexpected artifacts appearing outside the configured PACS storage directory, particularly in system directories, web roots, or startup locations
Web Portal upload events from authenticated sessions immediately followed by file creation events in unrelated paths on the host
Sante PACS Server process writing to file system locations that fall outside its documented working directories

Detection Strategies

Correlate authenticated Web Portal upload requests with file creation telemetry on the PACS host, and flag any writes that resolve outside the storage root
Inspect stored DCM files for path-bearing DICOM tags containing .., backslash, or forward-slash sequences that indicate traversal attempts
Alert on new executable, script, or configuration files created by the Sante PACS Server process account

Monitoring Recommendations

Enable verbose logging on the Sante PACS Server Web Portal and forward authentication and upload events to a central log platform
Monitor file integrity on directories adjacent to the PACS storage path, including web-served directories and service configuration folders
Review Web Portal user accounts for unusual creation, privilege changes, or logins from unexpected source addresses that could precede an upload-based attack

How to Mitigate CVE-2025-0572

Immediate Actions Required

Apply the vendor-supplied update for Sante PACS Server as soon as it is available, referencing ZDI-25-054 for version guidance
Restrict Web Portal access to trusted networks and authenticated clinical users only, removing any public internet exposure
Audit existing Web Portal accounts, disable unused credentials, and enforce strong, unique passwords

Patch Information

Santesoft has not published a vendor advisory URL in the NVD record. Administrators should consult the Santesoft support channel and the Zero Day Initiative Advisory ZDI-25-054 for the fixed version identifier, then upgrade all Sante PACS Server installations to that release.

Workarounds

Place the Web Portal behind a reverse proxy or VPN that enforces additional authentication and network-level access control
Run the Sante PACS Server process under a dedicated low-privilege account with file system permissions restricted to the PACS storage directory
Deploy host-based access controls or mandatory access control profiles that prevent the service account from writing outside its designated data path

bash

# Example: restrict Sante PACS Server service account to the storage directory (Windows icacls)
icacls "C:\Program Files\Sante PACS Server" /inheritance:r
icacls "C:\Program Files\Sante PACS Server" /grant:r "SantePACSSvc:(OI)(CI)M"
icacls "C:\Windows" /deny "SantePACSSvc:(OI)(CI)(W)"
icacls "C:\inetpub" /deny "SantePACSSvc:(OI)(CI)(W)"