Vulnerability intelligence
CVE-2026-50003
A malicious or compromised server can make a DCMTK client using bit-preserving C-GET storage mode write files outside the chosen output directory, using both relative (../) paths and absolute paths.
CVSS Score
9.8
Critical
EPSS — Exploit Probability
0.7%
Riskier than 50% of all CVEs · checked 2026-10-02
Exploitation
Not in CISA KEV
KEV does not include every exploited vulnerability
Remediation
unknown
Check vendor advisories
1 article across 1 outlet · first covered Jul 4, 2026 · latest Jul 4, 2026
Coverage timeline
-
CISA warns of DCMTK flaw allowing attackers to write filessecurityonline.info · Jul 4, 2026