CVE-2025-0573: Sante PACS Path Traversal Vulnerability

CVE-2025-0573 Overview

CVE-2025-0573 is a directory traversal vulnerability in Sante PACS Server that allows unauthenticated remote attackers to write arbitrary files on affected installations. The flaw resides in the parsing of DICOM (.DCM) files, where the application fails to validate user-supplied paths before performing file operations. Attackers can leverage this weakness to place files in unintended locations within the file system, in the security context of the running service. The vulnerability was disclosed through the Trend Micro Zero Day Initiative as ZDI-CAN-25309 and is categorized under CWE-22: Path Traversal.

Critical Impact
Unauthenticated remote attackers can write arbitrary files to the Sante PACS Server host by supplying a crafted DCM file, enabling potential integrity compromise of medical imaging infrastructure.

Affected Products

Santesoft Sante PACS Server (all versions prior to the vendor fix)
Deployments exposing the DICOM parsing service to untrusted networks
Healthcare environments running Sante PACS Server for medical image storage and retrieval

Discovery Timeline

2025-01-30 - CVE-2025-0573 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0573

Vulnerability Analysis

The vulnerability exists in the DCM file parser used by Sante PACS Server. DICOM files carry metadata elements that reference file names and paths used by the server during storage operations. The parser accepts these path components without normalizing or validating traversal sequences such as ../. As a result, an attacker who submits a crafted DCM file can direct write operations outside the intended storage directory.

Because the DICOM listener does not require authentication, the attack surface extends to any network peer capable of reaching the service port. The impact is limited to integrity of files under the service account's write permissions, but chained abuse — for example, planting a startup script, configuration file, or web-accessible payload — can escalate the impact well beyond a simple file creation.

Root Cause

The root cause is missing input validation on file path components extracted from parsed DCM data [CWE-22]. The application concatenates attacker-controlled path fragments into destination file paths without canonicalizing the result or enforcing a base-directory boundary check. Directory traversal payloads therefore resolve outside the intended PACS storage root.

Attack Vector

Exploitation occurs over the network without authentication or user interaction. An attacker crafts a DICOM object containing traversal sequences in path-related attributes and submits it through the standard DICOM store operation exposed by the PACS server. When the server parses the object and performs the write, the file lands at the attacker-chosen location. Technical details are documented in the Zero Day Initiative Advisory ZDI-25-053. No public proof-of-concept exploit code is available at this time.

Detection Methods for CVE-2025-0573

Indicators of Compromise

Files created outside the configured PACS storage directory by the Sante PACS Server process
DICOM C-STORE requests containing path traversal sequences (../, ..\) in file-name or path-related DICOM tags
Unexpected writes to system directories, web roots, or startup locations by the PACS service account
Newly created executables, scripts, or configuration files timestamped shortly after DICOM ingest activity

Detection Strategies

Inspect DICOM traffic on the PACS listener port for traversal patterns in metadata fields prior to reaching the server
Enable file integrity monitoring on directories adjacent to and outside the PACS storage root
Correlate PACS service process activity with file writes to sensitive OS paths using endpoint telemetry
Baseline normal DICOM sources and alert on unauthenticated store operations from unknown peers

Monitoring Recommendations

Forward Sante PACS Server logs and host file-write events to a centralized SIEM for correlation
Alert on any file creation by the PACS process outside its designated storage volume
Monitor outbound network connections from the PACS host to detect follow-on activity after arbitrary file placement
Track process creation events initiated by the PACS service account to identify potential execution of planted payloads

How to Mitigate CVE-2025-0573

Immediate Actions Required

Apply the latest Sante PACS Server update from Santesoft that addresses CVE-2025-0573
Restrict network access to the DICOM listener to trusted imaging modalities and workstations only
Run the PACS service under a least-privilege account without write access to system or web-accessible directories
Review PACS storage volumes and adjacent directories for unauthorized files created since deployment

Patch Information

Refer to the vendor advisory and the Zero Day Initiative Advisory ZDI-25-053 for fixed version details. Administrators should verify the installed build against the vendor's fixed release and confirm that DCM parsing routines enforce path canonicalization after the update.

Workarounds

Place the PACS server behind a segmented VLAN and firewall rules that limit inbound DICOM traffic to known source addresses
Deploy a DICOM-aware proxy or gateway that strips or rejects traversal sequences in metadata fields
Apply operating system access control lists to prevent the PACS service account from writing outside the storage volume
Disable unauthenticated DICOM store operations where the deployment supports peer authentication or TLS-based association negotiation

bash

# Configuration example: restrict inbound DICOM traffic to trusted modalities
# Replace 104 with the actual DICOM port configured for Sante PACS Server
iptables -A INPUT -p tcp --dport 104 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 104 -j DROP

# Enforce least-privilege on the storage directory (Linux example)
chown pacs-svc:pacs-svc /var/lib/sante-pacs/storage
chmod 750 /var/lib/sante-pacs/storage