GCVE-1988-2026-0477
Vulnerability from gna-1988 – Published: 2026-11-02 07:30 – Updated: 2026-11-02 07:30
VLAI
EPSS
VEX
Title
[SYSS-2026-079]: dcm4che - Path Traversal (CWE-22)
Summary
Advisory ID: SYSS-2026-079
Product: dcm4che
Manufacturer: J4Care
Affected Version(s): 5.35.0
Tested Version(s): 5.35.0
Risk Level: High
Solution Status: Open
Manufacturer Notification: 2026-08-06
Public Disclosure: 2026-10-13
CVE Reference: Not yet assigned
Author of Advisory: Matthias Deeg, SySS GmbH
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Overview:
and transmitting DICOM data (see [1]).
The Agfa2Dcm command-line tool in dcm4che is vulnerable to a path traversal
attack. An attacker who can supply an Agfa ARCHIVE-BLOB DICOM file for
processing with Agfa2Dcm can write extracted data outside the configured
output directory by injecting "../" sequences into DICOM attribute values.
This allows attackers to achieve arbitrary file write on the target system.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Vulnerability Details:
The Agfa2Dcm tool processes Agfa ARCHIVE-BLOB DICOM files by extracting
embedded file entries. Each entry's output path is constructed using
AttributesFormat.format(), which substitutes DICOM attribute values into a
configurable filename pattern (see Agfa2Dcm.java:140):
list.add(part = new Part(format.format(attrs),
dis.getPosition() + headerLength));
The default format pattern is {00080018} (SOPInstanceUID). The formatted
result is used directly as a file path component when extracting the
embedded data (Agfa2Dcm.java:146-149):
Path outPath = Paths.get(outDir, part.path);
Files.createDirectories(outPath.getParent());
try (OutputStream out = Files.newOutputStream(outPath)) {
StreamUtils.copy(in, out, part.length, buffer);
}
No path validation is performed. If a DICOM attribute value contains
"../" sequences, the resulting path escapes the configured output
directory.
A crafted ARCHIVE-BLOB file can be created by encoding the file
padding (16384 bytes of zeros), the "ARCHIVE-BLOB" header (12 bytes),
and DICOM data elements including a (0008,0018) SOPInstanceUID element
with a path traversal payload as its value. The agfa2dcm binary processes
such a file without error, writing the extracted data outside the intended
directory.
The root cause is the missing validation of format.format() output before
its use in file path operations.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Proof of Concept (PoC):
The path traversal can be demonstrated by creating an ARCHIVE-BLOB file
with a path traversal payload in the SOPInstanceUID field, for example,
using the following Python script.
The output directory for agfa2dcm (in this example "/tmp/output") has to
exist.
cat > poc.py << 'EOF'
#!/usr/bin/env python3
import struct, subprocess, os
TRAVERSAL = "../outside_agfa2dcm"
# Build DICOM element: (0008,0018) VR=UI value=../outside_agfa2dcm
val = TRAVERSAL.encode('ascii')
# ARCHIVE-BLOB file: 16384 zeros + header + DICOM element
with open("malicious.blob", "wb") as f:
f.write(b'\x00' * 16384)
f.write(b"ARCHIVE-BLOB")
f.write(elem)
# Run agfa2dcm
# agfa2dcm -d /tmp/output malicious.blob
# Verify: file written at /tmp/outside_agfa2dcm (outside /tmp/output)
EOF
The file is written to /tmp/outside_agfa2dcm, one directory level above the
configured output directory, confirming the path traversal.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Solution:
SySS GmbH is not aware of a security update for the described issue.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Disclosure Timeline:
2026-08-06: Vulnerability reported to manufacturer
2026-09-04: Vulnerability reported to manufacturer again
2026-10-13: Public release of security advisory
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
References:
[1] dcm4che project website
https://www.dcm4che.org/
[2] SySS Security Advisory SYSS-2026-079
[3] SySS GmbH, SySS Responsible Disclosure Policy
https://www.syss.de/en/responsible-disclosure-policy
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Credits:
This security vulnerability was found by Matthias Deeg of SySS GmbH with
the assistance of SySS AI.
E-Mail: matthias.deeg (at) syss.de
Key fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Disclaimer:
The information provided in this security advisory is provided "as is"
and without warranty of any kind. Details of this security advisory may
be updated in order to provide as accurate information as possible. The
latest version of this security advisory is available on the SySS
website.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Copyright:
Creative Commons - Attribution (by) - Version 4.0
URL: https://creativecommons.org/licenses/by/4.0/deed.en
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
CWE
Assigner
References
7 references
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "dcm4che",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Matthias Deeg via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "Advisory ID: SYSS-2026-079\nProduct: dcm4che\nManufacturer: J4Care\nAffected Version(s): 5.35.0\nTested Version(s): 5.35.0\n\nRisk Level: High\nSolution Status: Open\nManufacturer Notification: 2026-08-06\nPublic Disclosure: 2026-10-13\nCVE Reference: Not yet assigned\nAuthor of Advisory: Matthias Deeg, SySS GmbH\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nOverview:\n\n\nand transmitting DICOM data (see [1]).\n\nThe Agfa2Dcm command-line tool in dcm4che is vulnerable to a path traversal\nattack. An attacker who can supply an Agfa ARCHIVE-BLOB DICOM file for\nprocessing with Agfa2Dcm can write extracted data outside the configured\noutput directory by injecting \"../\" sequences into DICOM attribute values.\n\nThis allows attackers to achieve arbitrary file write on the target system.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nVulnerability Details:\n\nThe Agfa2Dcm tool processes Agfa ARCHIVE-BLOB DICOM files by extracting\nembedded file entries. Each entry\u0027s output path is constructed using\nAttributesFormat.format(), which substitutes DICOM attribute values into a\nconfigurable filename pattern (see Agfa2Dcm.java:140):\n\n list.add(part = new Part(format.format(attrs),\n dis.getPosition() + headerLength));\n\nThe default format pattern is {00080018} (SOPInstanceUID). The formatted\nresult is used directly as a file path component when extracting the\nembedded data (Agfa2Dcm.java:146-149):\n\n Path outPath = Paths.get(outDir, part.path);\n Files.createDirectories(outPath.getParent());\n try (OutputStream out = Files.newOutputStream(outPath)) {\n StreamUtils.copy(in, out, part.length, buffer);\n }\n\nNo path validation is performed. If a DICOM attribute value contains\n\"../\" sequences, the resulting path escapes the configured output\ndirectory.\n\nA crafted ARCHIVE-BLOB file can be created by encoding the file\npadding (16384 bytes of zeros), the \"ARCHIVE-BLOB\" header (12 bytes),\nand DICOM data elements including a (0008,0018) SOPInstanceUID element\nwith a path traversal payload as its value. The agfa2dcm binary processes\nsuch a file without error, writing the extracted data outside the intended\ndirectory.\n\nThe root cause is the missing validation of format.format() output before\nits use in file path operations.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nProof of Concept (PoC):\n\nThe path traversal can be demonstrated by creating an ARCHIVE-BLOB file\nwith a path traversal payload in the SOPInstanceUID field, for example,\nusing the following Python script.\n\nThe output directory for agfa2dcm (in this example \"/tmp/output\") has to\nexist.\n\ncat \u003e poc.py \u003c\u003c \u0027EOF\u0027\n#!/usr/bin/env python3\nimport struct, subprocess, os\n\nTRAVERSAL = \"../outside_agfa2dcm\"\n\n# Build DICOM element: (0008,0018) VR=UI value=../outside_agfa2dcm\nval = TRAVERSAL.encode(\u0027ascii\u0027)\n\n\n# ARCHIVE-BLOB file: 16384 zeros + header + DICOM element\nwith open(\"malicious.blob\", \"wb\") as f:\n f.write(b\u0027\\x00\u0027 * 16384)\n f.write(b\"ARCHIVE-BLOB\")\n f.write(elem)\n\n# Run agfa2dcm\n# agfa2dcm -d /tmp/output malicious.blob\n\n# Verify: file written at /tmp/outside_agfa2dcm (outside /tmp/output)\nEOF\n\nThe file is written to /tmp/outside_agfa2dcm, one directory level above the\nconfigured output directory, confirming the path traversal.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSolution:\n\nSySS GmbH is not aware of a security update for the described issue.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclosure Timeline:\n\n2026-08-06: Vulnerability reported to manufacturer\n2026-09-04: Vulnerability reported to manufacturer again\n2026-10-13: Public release of security advisory\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nReferences:\n\n[1] dcm4che project website\n https://www.dcm4che.org/\n[2] SySS Security Advisory SYSS-2026-079\n\n[3] SySS GmbH, SySS Responsible Disclosure Policy\n https://www.syss.de/en/responsible-disclosure-policy\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCredits:\n\nThis security vulnerability was found by Matthias Deeg of SySS GmbH with\nthe assistance of SySS AI.\n\nE-Mail: matthias.deeg (at) syss.de\n\nKey fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclaimer:\n\nThe information provided in this security advisory is provided \"as is\"\nand without warranty of any kind. Details of this security advisory may\nbe updated in order to provide as accurate information as possible. The\nlatest version of this security advisory is available on the SySS\nwebsite.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCopyright:\n\nCreative Commons - Attribution (by) - Version 4.0\nURL: https://creativecommons.org/licenses/by/4.0/deed.en\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T07:30:01Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Oct/24"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Oct/24"
},
{
"url": "https://creativecommons.org/licenses/by/4.0/deed.en"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.dcm4che.org/"
},
{
"url": "https://www.syss.de/en/responsible-disclosure-policy"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Oct/24"
],
"discovery": "EXTERNAL"
},
"title": "[SYSS-2026-079]: dcm4che - Path Traversal (CWE-22)",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0477",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Oct/24",
"automated": true,
"contentSha256": "0551f772d8fb9c79e712550e2c028edd0819ec63fd8e767b357564d38a60147f",
"evidenceScore": 10,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Oct/24",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-10-15T07:32:08Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-11-02T07:30:01Z",
"dateUpdated": "2026-11-02T07:30:01Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0477"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.