Vulnerability intelligence

CVE-2026-50003

A malicious or compromised server can make a DCMTK client using bit-preserving C-GET storage mode write files outside the chosen output directory, using both relative (../) paths and absolute paths.

CVSS Score

9.8

Critical

EPSS — Exploit Probability

0.5%

Riskier than 40% of all CVEs

Exploitation

Not in CISA KEV

No federal exploitation record

Remediation

unknown

Check vendor advisories

NVD entry PoC / advisory

1 article across 1 outlet · first covered Jul 4, 2026 · latest Jul 4, 2026

Coverage timeline

CISA warns of DCMTK flaw allowing attackers to write files
securityonline.info · Jul 4, 2026