CVE-2026-50003: DCMTK Path Traversal Vulnerability

CVE-2026-50003 Overview

CVE-2026-50003 is a path traversal vulnerability [CWE-22] affecting the DICOM Toolkit (DCMTK) client. A malicious or compromised DICOM server can force a DCMTK client operating in bit-preserving C-GET storage mode to write files outside the chosen output directory. The flaw accepts both relative traversal sequences such as ../ and absolute paths supplied by the server. Exploitation requires no authentication and no user interaction across the network. The issue was disclosed in CISA Medical Advisory ICSMA-26-181-01, indicating relevance to healthcare and medical imaging environments where DCMTK is widely deployed for DICOM image handling.

Critical Impact
A remote server can write arbitrary files to attacker-chosen locations on the DCMTK client host, enabling code execution paths through overwrite of binaries, scripts, or configuration files.

Affected Products

DCMTK (DICOM Toolkit) client using bit-preserving C-GET storage mode
Medical imaging systems and PACS integrations that embed DCMTK
Downstream applications linking DCMTK libraries for DICOM transfers

Discovery Timeline

2026-06-30 - CVE-2026-50003 published to NVD
2026-07-01 - Last updated in NVD database
ICSMA-26-181-01 - CISA Medical Advisory released

Technical Details for CVE-2026-50003

Vulnerability Analysis

DCMTK implements DICOM network services including C-GET, a query/retrieve operation where a client requests objects from a peer Service Class Provider (SCP). In bit-preserving storage mode, the client writes received datasets to disk without re-encoding, preserving the original byte stream. The vulnerability exists because the client uses server-supplied identifiers to derive the destination filename without normalizing or constraining the path to the configured output directory. A hostile server can therefore dictate where files land on the client filesystem.

The defect is a classic path traversal issue [CWE-22]. Both dot-dot traversal sequences (../../etc/cron.d/payload) and absolute paths (/etc/ld.so.preload on Linux or C:\Windows\System32\... on Windows) are honored. Because C-GET clients typically run with the privileges of the imaging workstation user or a service account, the write primitive frequently reaches sensitive locations.

Root Cause

The root cause is missing input validation on filename or path components derived from the remote peer during C-GET reception in bit-preserving mode. The client trusts server-provided naming data and passes it into filesystem write operations without canonicalization checks or restriction to the chosen output directory.

Attack Vector

An attacker operates or compromises a DICOM SCP that a DCMTK client contacts for C-GET retrieval. When the client initiates the retrieval, the server returns responses referencing filenames containing ../ sequences or absolute paths. The DCMTK client writes the incoming dataset to the attacker-chosen path. Depending on the target file, this yields configuration tampering, script or binary overwrite, or persistence, and can escalate to arbitrary code execution on the client host.

// No verified public exploit code is available for CVE-2026-50003.
// Refer to the CISA advisory and DCMTK release notes for technical details.

Detection Methods for CVE-2026-50003

Indicators of Compromise

Files created outside the configured DCMTK output directory following a C-GET session, especially in system paths such as /etc, /root, ~/.ssh, or C:\Windows\
DCMTK client logs referencing filenames containing .., forward or backward slashes, or absolute path prefixes
Unexpected outbound DICOM connections from imaging workstations to unknown SCP hosts or non-standard ports

Detection Strategies

Monitor filesystem events for write operations by DCMTK processes (movescu, getscu, or applications linking DCMTK) that resolve outside the designated storage directory.
Inspect DICOM transaction logs for C-GET responses whose SOP Instance filename fields contain traversal characters or absolute path markers.
Alert on modifications to sensitive system files with a DCMTK-related process ancestry.

Monitoring Recommendations

Baseline expected DICOM peer endpoints and flag connections to unapproved SCPs.
Enable verbose DCMTK logging to capture received filenames and correlate with EDR file-write telemetry.
Review scheduled tasks, cron entries, and startup directories for unexpected artifacts after DICOM retrievals.

How to Mitigate CVE-2026-50003

Immediate Actions Required

Upgrade DCMTK to the fixed release documented in the GitHub DCMTK Release Notes.
Disable bit-preserving C-GET storage mode until patched clients are deployed.
Restrict outbound DICOM connectivity from clinical workstations to an allowlist of trusted SCPs.

Patch Information

The DCMTK maintainers have published fixes referenced in the project release notes. Consult the CISA Medical Advisory ICSMA-26-181-01 and the CISA CSAF JSON File for authoritative version details and vendor-specific guidance. Vendors that embed DCMTK in medical imaging products should rebuild against the fixed version and issue product-level updates.

Workarounds

Run DCMTK client processes under a low-privilege service account with write access limited to the DICOM output directory via filesystem ACLs.
Place the DCMTK output directory on a dedicated mount and use mandatory access controls (SELinux, AppArmor) to confine writes.
Segment imaging networks so DCMTK clients only reach validated internal SCPs, blocking arbitrary external DICOM endpoints.

bash

# Example: constrain the DCMTK service account write scope on Linux
useradd -r -s /usr/sbin/nologin dcmtk-svc
mkdir -p /var/lib/dcmtk/incoming
chown dcmtk-svc:dcmtk-svc /var/lib/dcmtk/incoming
chmod 700 /var/lib/dcmtk/incoming
# Deny write access elsewhere via AppArmor/SELinux profile targeting the DCMTK binary