This vulnerability involves improper limitation of a pathname to a restricted directory (CWE-22) in the DCMTK Toolkit by OFFIS DICOM. Specifically, when using the bit-preserving C-GET storage mode, a malicious or compromised server can manipulate file paths to cause the client to write files outside the designated output directory. Both relative and absolute path traversal techniques are possible, enabling potential unauthorized file system modifications on the client side. No patch or official remediation has been documented as of the published date.

Exploitation of this vulnerability can allow an attacker controlling or compromising a DICOM server to write files arbitrarily on the client system running DCMTK. This can lead to unauthorized file creation or overwriting, potentially resulting in system compromise, data corruption, or other malicious outcomes. The CVSS 4.0 score of 9.3 reflects a critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with untrusted DICOM servers, especially when using bit-preserving C-GET storage mode. Restricting network access to trusted servers and monitoring for unusual file system activity may help reduce risk.