Skip to content
NewA calmer, faster ZeroHour
Vulnerabilityhigh

[SYSS-2026-080]: dcm4che - Path Traversal (CWE-22)

Full Disclosure ()2 · 1 read
Read at seclists.org
Part of a story covered by 4 sourcesSySS and CISA report separate J4Care imaging flawsMerged summary & timeline
AI summary · grok-4.7-buildSummaries by Vani AI

SySS disclosed an unpatched high-risk path traversal in dcm4che 5.35.0, with no CVE yet.

SySS advisory SYSS-2026-080 discloses a path-traversal flaw (CWE-22) in dcm4che, the open-source DICOM software from J4Care. Affected and tested version is 5.35.0. The risk is rated high, the fix status is open, the vendor was notified on August 6, 2026, and public disclosure followed on October 13, 2026. A CVE reference is not yet assigned, and the notice does not report active exploitation.

Key facts
  • Path traversal is CWE-22 in dcm4che 5.35.0, tested on that version.
  • SySS rates the risk high and lists the solution status as open.
  • J4Care was notified on August 6, 2026; disclosure was October 13, 2026.
  • No CVE has been assigned yet, and exploitation is not reported.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Tags
dcm4chepath-traversalcwe-22dicomj4caresyssunpatched
Vendors
J4Care
Products
dcm4che
Organizations
SySS

From the original article

Posted by Matthias Deeg via Fulldisclosure on Oct 15 Advisory ID: SYSS-2026-080 Product: dcm4che Manufacturer: J4Care Affected Version(s): 5. 35. 0 Tested Version(s): 5.

Full Disclosure

seclists.org

Read the full article at Full Disclosure

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.