This vulnerability (CWE-22) in the OFFIS DICOM DCMTK Toolkit involves improper limitation of a pathname to a restricted directory. Specifically, when a DCMTK client uses bit-preserving C-GET storage mode, a malicious or compromised server can manipulate file paths to write files outside the chosen output directory. Both relative path traversal sequences (../) and absolute paths can be used to bypass directory restrictions, potentially allowing arbitrary file writes on the client system. The CVSS 4.0 base score is 9.3, indicating a critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker controlling or impersonating a server to write files to arbitrary locations on the client system running DCMTK. This can lead to unauthorized file modification or creation, potentially compromising system integrity and confidentiality. The vulnerability does not require privileges or user interaction and can be exploited remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation is currently documented. Until a patch is available, users should exercise caution when connecting DCMTK clients to untrusted or potentially compromised servers, as the vulnerability can be exploited remotely without authentication or user interaction.