The vulnerability arises from the qrscp application's C-STORE handler in the pynetdicom library version 1.0.0, which uses a specific instance from attacker-controlled DICOM datasets directly in os.path.join() without proper sanitization or validation. This improper limitation of a pathname to a restricted directory (CWE-22) enables an attacker to perform path traversal and write files to arbitrary locations on the filesystem. The CVSS 4.0 base score is 8.8, reflecting network attack vector, low attack complexity, no privileges or user interaction required, but high impact on confidentiality and availability.

Successful exploitation allows an unauthenticated remote attacker to write files to arbitrary paths on the affected system, potentially leading to unauthorized data modification, system compromise, or denial of service. The vulnerability affects confidentiality and availability with high impact, as indicated by the CVSS score.

No official patch or remediation is currently available for this vulnerability. Users of pynetdicom library version 1.0.0 should apply strict input validation and sanitization on DICOM dataset values used in file path operations as a temporary mitigation. Monitor vendor advisories for updates or official fixes.