This vulnerability (CWE-22) in the OFFIS DICOM DCMTK Toolkit enables an unauthenticated attacker to perform path traversal attacks, thereby accessing worklist records stored outside the designated directory boundaries. The flaw compromises data separation in environments where multiple areas or clinics use the toolkit, potentially exposing sensitive medical scheduling information across organizational boundaries. The CVSS 4.0 base score is 8.8, reflecting network attack vector, no privileges or user interaction required, and high confidentiality impact.

An attacker can read sensitive worklist records from unauthorized directories, breaching data confidentiality and potentially exposing patient or clinic information across separated areas. This undermines data isolation in multi-area deployments, increasing the risk of information disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been provided at this time. Users should monitor OFFIS DICOM advisories for updates and apply patches once available.