CVE-2026-52868: Path Traversal Vulnerability Exposed

CVE-2026-52868 Overview

CVE-2026-52868 is a path traversal vulnerability [CWE-22] affecting the DICOM Toolkit (DCMTK) worklist server component. An unauthenticated remote attacker can read worklist records from directories outside the intended per-Application Entity (AE) worklist storage area. In multi-area deployments, exploitation crosses departmental or clinic data separation boundaries, exposing protected health information (PHI) across administrative zones.

The issue was published in the National Vulnerability Database on 2026-06-30 and last modified on 2026-07-01. CISA issued an ICS Medical Advisory (ICSMA-26-181-01) covering the flaw, reflecting its relevance to healthcare environments running DICOM services.

Critical Impact
Unauthenticated network attackers can read arbitrary worklist records outside the target AE scope, breaking tenant isolation in multi-department hospital deployments.

Affected Products

DCMTK (DICOM Toolkit) worklist server components
Healthcare imaging deployments using per-AE worklist storage separation
Multi-area PACS and modality worklist environments referenced in CISA ICSMA-26-181-01

Discovery Timeline

2026-06-30 - CVE-2026-52868 published to the National Vulnerability Database
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-52868

Vulnerability Analysis

DCMTK exposes a DICOM modality worklist service that serves per-AE record files from an isolated directory tree. Each AE Title receives its own storage scope so that departments, clinics, or tenants cannot see each other's scheduled procedures. The vulnerability breaks that separation.

An unauthenticated attacker submits a crafted request that references worklist records outside the AE-scoped directory. The service resolves the path without properly restricting traversal, returning worklist content from adjacent AE directories. Because the DICOM worklist protocol operates over the network without required authentication in many deployments, the attacker needs no credentials.

Disclosed worklist records typically contain patient identifiers, scheduled procedure steps, referring physician data, and accession numbers. This creates a confidentiality breach with regulatory implications under HIPAA and equivalent frameworks.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The worklist server accepts input that influences file resolution without normalizing the path or enforcing a boundary check against the per-AE base directory. Directory traversal sequences or absolute path fragments escape the intended sandbox.

Attack Vector

Exploitation occurs over the network against the DICOM worklist listener, which typically runs on TCP port 104 or a configured alternate port. The attacker establishes an association with the worklist service and issues a query containing traversal input that references records in another AE's storage directory. No user interaction, credentials, or elevated privileges are required.

The vulnerability manifests in the worklist file lookup logic within DCMTK. Refer to the GitHub DCMTK Release Notes and the CISA ICS Medical Advisory for authoritative technical details.

Detection Methods for CVE-2026-52868

Indicators of Compromise

DICOM association requests to the worklist service from unexpected source addresses or outside change windows
Worklist query logs referencing AE Titles or file paths inconsistent with the querying host's assigned scope
Path traversal sequences such as ../, encoded variants, or absolute paths appearing in worklist query parameters
Unusual read volume against worklist directories belonging to other departments or tenants

Detection Strategies

Inspect DCMTK worklist server logs (wlmscpfs and equivalent) for queries whose resolved file paths fall outside the configured per-AE base directory
Deploy network monitoring rules that flag DICOM C-FIND requests containing traversal metacharacters in worklist attributes
Correlate DICOM association events with expected AE-to-host mappings and alert on mismatches

Monitoring Recommendations

Forward worklist server logs to a centralized SIEM and alert on cross-AE file access patterns
Baseline normal worklist query volume per AE and alert on statistical deviations
Monitor the CISA ICS Medical Advisory page and DCMTK release notes for updated indicators

How to Mitigate CVE-2026-52868

Immediate Actions Required

Inventory all DCMTK-based worklist services and confirm the running version against the fixed release listed in the DCMTK Release Notes
Restrict network access to the worklist listener to authorized modalities and clinical workstations only
Review recent worklist server logs for evidence of cross-AE record access
Notify privacy and compliance teams if evidence of unauthorized disclosure is found

Patch Information

Apply the DCMTK release referenced in the GitHub DCMTK Release Notes that addresses the worklist path handling. Follow the remediation guidance in the CISA ICS Medical Advisory ICSMA-26-181-01 and the associated CSAF advisory document.

Workarounds

Place the worklist service behind a VLAN or firewall that permits only known modality source addresses
Enforce per-AE filesystem permissions so that the worklist process cannot read directories belonging to other AEs
Deploy a DICOM-aware proxy that validates AE Title-to-source mappings before forwarding queries
Segment multi-department deployments so each clinic runs an isolated worklist instance until patching completes

bash

# Example: restrict worklist listener with host-based firewall (Linux)
# Replace 104 with your configured DICOM port and use only trusted modality IPs
iptables -A INPUT -p tcp --dport 104 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 104 -j DROP

# Example: enforce per-AE directory permissions
chown -R dcmtk:ae_dept_a /var/dcmtk/worklist/DEPT_A
chmod 750 /var/dcmtk/worklist/DEPT_A