What’s Vulnerable › Vulnerabilities

CVE-2022-2120: OFFIS DCMTK Path Traversal

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-06-24 · updated 2026-06-17
• Weakness: CWE-23

Description

OFFIS DCMTK's (All versions prior to 3.6.7) service class user (SCU) is vulnerable to relative path traversal, allowing an attacker to write DICOM files into arbitrary directories under controlled names. This could allow remote code execution.

Affected products

• OFFIS DCMTK: before 3.6.7 — fixed in 3.6.7

How to fix

Upgrade to a fixed version: OFFIS DCMTK 3.6.7. Check the vendor advisory for mitigations.

References

• https://www.cisa.gov/uscert/ics/advisories/icsma-22-174-01
• https://lists.debian.org/debian-lts-announce/2025/06/msg00025.html
• https://www.cisa.gov/uscert/ics/advisories/icsma-22-174-01

Get alerted when CVE-2022-2120 or the next vulnerability affects your stack