A malicious or compromised server can make a DCMTK client using bit-preserving C-GET storage mode write files outside the chosen output directory,… (CVE-2026-50003)

CVE-2026-50003 describes a path traversal vulnerability in the DCMTK client when operating in bit-preserving C-GET storage mode. A malicious or compromised server can exploit this flaw to instruct the client to write files outside the designated output directory by leveraging both relative and absolute filesystem paths. This behavior can result in arbitrary file writes, potentially compromising the client system's integrity and confidentiality.

Successful exploitation allows an attacker controlling the server to write files to arbitrary locations on the client system, bypassing intended directory restrictions. This can lead to data corruption, unauthorized data modification, or potential code execution depending on the files written and the client environment. The CVSS score of 9.8 indicates a critical severity with network attack vector, no privileges required, and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid using bit-preserving C-GET storage mode with untrusted servers or restrict network access to trusted servers only.