What’s Vulnerable › Vulnerabilities

CVE-2020-37009: MedDream PACS Server 6.8.3.751 - Remote Code Execution

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-01-29 · updated 2026-06-17
• Weakness: CWE-434

Description

MedDream PACS Server 6.8.3.751 contains an authenticated remote code execution vulnerability that allows authorized users to upload malicious PHP files. Attackers can exploit the uploadImage.php endpoint by authenticating and uploading a PHP shell to execute arbitrary system commands with elevated privileges.

Affected products

• MedDream PACS Server: 6.8.3.751

References

• https://meddream.com/products/meddream-pacs-server/
• https://www.exploit-db.com/exploits/48853
• https://www.vulncheck.com/advisories/meddream-pacs-server-remote-code-execution
• https://www.exploit-db.com/exploits/48853

Get alerted when CVE-2020-37009 or the next vulnerability affects your stack