SySS and CISA report separate J4Care imaging flaws

SySS disclosed four unpatched high-risk path traversals in dcm4che 5.35.0; CISA separately warns of six flaws in dcm4chee-arc-light 5.35.1, fixed in 5.35.2.

SySS posted four Full Disclosure advisories, SYSS-2026-077 through SYSS-2026-080, each describing a CWE-22 path traversal in J4Care's open-source DICOM software dcm4che. Each names affected and tested version 5.35.0, lists solution status as Open, and gives vendor notification on 6 August 2026 with public disclosure on 13 October 2026. Three reports attribute the High risk rating to SySS, while the SYSS-2026-079 report says the vendor rates the risk High; three say the available text lacks a complete CVE id, while SYSS-2026-080 says a CVE has not been assigned, and none reports exploitation. Separately, CISA's ICS medical advisory covers six vulnerabilities in J4Care dcm4chee-arc-light 5.35.1, including CVE-2026-97851 (CVSS 9.1), which lets an unauthenticated attacker change storage locations so the purge scheduler deletes referenced objects, plus parser denial-of-service issues and a default configuration that accepts unregistered DICOM peers for C-FIND, C-GET, and forged C-STORE. J4Care recommends upgrading to 5.35.2 or later, and the reports do not state that the SySS advisories correspond to the CISA CVEs.