High
orthanc — security advisory
Orthanc before 1.12.0 allows authenticated users with access to the Orthanc API to overwrite arbitrary files on the file system, and in specific deployment scenarios allows the attacker to overwrite the configuration, which can be exploited to trigger Remote Code Execution (RCE).
- Products
- orthanc
- Affected versions
- 0.9.4+dfsg-1, 0.9.4+dfsg-2, 0.9.5+dfsg-1, 1.0.0+dfsg-1, 1.0.0+dfsg-1build1, 1.10.0+dfsg-1, 1.12.1+dfsg-3, 1.12.1+dfsg-4, 1.12.1+dfsg-4build1, 1.12.10+dfsg-1, 1.12.10+dfsg-1build1, 1.12.10+dfsg-2, 1.12.11+dfsg-8, 1.12.11+dfsg-8build1, 1.12.2+dfsg-1, 1.12.2+dfsg-1build3, 1.12.2+dfsg-1build4, 1.12.6+dfsg-1, 1.12.7+dfsg-4, 1.12.7+dfsg-4build2, 1.12.9+dfsg-2, 1.3.0+dfsg-1build1, 1.3.0+dfsg-1build2, 1.3.1+dfsg-1, 1.3.1+dfsg-1build1, 1.3.1+dfsg-1build2, 1.5.7+dfsg-2, 1.5.8+dfsg-2, 1.5.8+dfsg-2ubuntu2, 1.5.8+dfsg-2ubuntu3, 1.5.8+dfsg-2ubuntu4, 1.5.8+dfsg-2ubuntu5, 1.5.8+dfsg-2ubuntu6, 1.9.2+really1.9.1+dfsg-1, 1.9.7+dfsg-3ubuntu1, 1.9.7+dfsg-3ubuntu2, 1.9.7+dfsg-4, 1.9.7+dfsg-5, 1.9.7+dfsg-6
- Fixed versions
- Not specified
- CVEs
- CVE-2023-33466
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 01:42 UTC · Revision 1
Source evidence
Orthanc before 1.12.0 allows authenticated users with access to the Orthanc API to overwrite arbitrary files on the file system, and in specific deployment scenarios allows the attacker to overwrite the configuration, which can be exploited to trigger Remote Code Execution (RCE).
osv:UBUNTU-CVE-2023-33466
orthanc
Fixed versions: Not specified
orthanc
Fixed versions: Not specified
orthanc
Fixed versions: Not specified
orthanc
Fixed versions: Not specified
orthanc
Fixed versions: Not specified
orthanc
Fixed versions: Not specified
orthanc
Fixed versions: Not specified
orthanc
Fixed versions: Not specified
Complete source record
{
"id": "935a21ac01463d1129e470764ad47dba38fc3aabeac142081c78130c9605ec0f",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2023-33466",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2023-33466",
"summary": "Orthanc before 1.12.0 allows authenticated users with access to the Orthanc API to overwrite arbitrary files on the file system, and in specific deployment scenarios allows the attacker to overwrite the configuration, which can be exploited to trigger Remote Code Execution (RCE).",
"evidence": "osv:UBUNTU-CVE-2023-33466",
"products": [
{
"name": {
"value": "orthanc",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.9.4+dfsg-1",
"evidence": "/affected/0/versions"
},
{
"value": "0.9.4+dfsg-2",
"evidence": "/affected/0/versions"
},
{
"value": "0.9.5+dfsg-1",
"evidence": "/affected/0/versions"
},
{
"value": "1.0.0+dfsg-1",
"evidence": "/affected/0/versions"
},
{
"value": "1.0.0+dfsg-1build1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "orthanc",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.3.0+dfsg-1build1",
"evidence": "/affected/1/versions"
},
{
"value": "1.3.0+dfsg-1build2",
"evidence": "/affected/1/versions"
},
{
"value": "1.3.1+dfsg-1",
"evidence": "/affected/1/versions"
},
{
"value": "1.3.1+dfsg-1build1",
"evidence": "/affected/1/versions"
},
{
"value": "1.3.1+dfsg-1build2",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "orthanc",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.5.7+dfsg-2",
"evidence": "/affected/2/versions"
},
{
"value": "1.5.8+dfsg-2",
"evidence": "/affected/2/versions"
},
{
"value": "1.5.8+dfsg-2ubuntu2",
"evidence": "/affected/2/versions"
},
{
"value": "1.5.8+dfsg-2ubuntu3",
"evidence": "/affected/2/versions"
},
{
"value": "1.5.8+dfsg-2ubuntu4",
"evidence": "/affected/2/versions"
},
{
"value": "1.5.8+dfsg-2ubuntu5",
"evidence": "/affected/2/versions"
},
{
"value": "1.5.8+dfsg-2ubuntu6",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "orthanc",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.9.2+really1.9.1+dfsg-1",
"evidence": "/affected/3/versions"
},
{
"value": "1.9.7+dfsg-3ubuntu1",
"evidence": "/affected/3/versions"
},
{
"value": "1.9.7+dfsg-3ubuntu2",
"evidence": "/affected/3/versions"
},
{
"value": "1.9.7+dfsg-4",
"evidence": "/affected/3/versions"
},
{
"value": "1.9.7+dfsg-5",
"evidence": "/affected/3/versions"
},
{
"value": "1.9.7+dfsg-6",
"evidence": "/affected/3/versions"
},
{
"value": "1.10.0+dfsg-1",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "orthanc",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.12.1+dfsg-3",
"evidence": "/affected/4/versions"
},
{
"value": "1.12.1+dfsg-4",
"evidence": "/affected/4/versions"
},
{
"value": "1.12.1+dfsg-4build1",
"evidence": "/affected/4/versions"
},
{
"value": "1.12.2+dfsg-1",
"evidence": "/affected/4/versions"
},
{
"value": "1.12.2+dfsg-1build3",
"evidence": "/affected/4/versions"
},
{
"value": "1.12.2+dfsg-1build4",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "orthanc",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.12.6+dfsg-1",
"evidence": "/affected/5/versions"
},
{
"value": "1.12.7+dfsg-4",
"evidence": "/affected/5/versions"
},
{
"value": "1.12.7+dfsg-4build2",
"evidence": "/affected/5/versions"
}
]
},
{
"name": {
"value": "orthanc",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.12.10+dfsg-2",
"evidence": "/affected/6/versions"
},
{
"value": "1.12.11+dfsg-8",
"evidence": "/affected/6/versions"
},
{
"value": "1.12.11+dfsg-8build1",
"evidence": "/affected/6/versions"
}
]
},
{
"name": {
"value": "orthanc",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.12.7+dfsg-4build2",
"evidence": "/affected/7/versions"
},
{
"value": "1.12.9+dfsg-2",
"evidence": "/affected/7/versions"
},
{
"value": "1.12.10+dfsg-1",
"evidence": "/affected/7/versions"
},
{
"value": "1.12.10+dfsg-1build1",
"evidence": "/affected/7/versions"
},
{
"value": "1.12.10+dfsg-2",
"evidence": "/affected/7/versions"
}
]
}
],
"severity": "high",
"structured": {
"id": "UBUNTU-CVE-2023-33466",
"aliases": [
"UBUNTU-CVE-2023-33466"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "orthanc",
"purl": "pkg:deb/ubuntu/orthanc?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"0.9.4+dfsg-1",
"0.9.4+dfsg-2",
"0.9.5+dfsg-1",
"1.0.0+dfsg-1",
"1.0.0+dfsg-1build1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-33466.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "orthanc",
"binary_version": "1.0.0+dfsg-1build1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "orthanc",
"purl": "pkg:deb/ubuntu/orthanc?arch=source&distro=bionic",
"ecosystem": "Ubuntu:18.04:LTS"
},
"versions": [
"1.3.0+dfsg-1build1",
"1.3.0+dfsg-1build2",
"1.3.1+dfsg-1",
"1.3.1+dfsg-1build1",
"1.3.1+dfsg-1build2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-33466.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "orthanc",
"binary_version": "1.3.1+dfsg-1build2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "orthanc",
"purl": "pkg:deb/ubuntu/orthanc?arch=source&distro=focal",
"ecosystem": "Ubuntu:20.04:LTS"
},
"versions": [
"1.5.7+dfsg-2",
"1.5.8+dfsg-2",
"1.5.8+dfsg-2ubuntu2",
"1.5.8+dfsg-2ubuntu3",
"1.5.8+dfsg-2ubuntu4",
"1.5.8+dfsg-2ubuntu5",
"1.5.8+dfsg-2ubuntu6"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-33466.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "orthanc",
"binary_version": "1.5.8+dfsg-2ubuntu6"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "orthanc",
"purl": "pkg:deb/ubuntu/orthanc?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"1.9.2+really1.9.1+dfsg-1",
"1.9.7+dfsg-3ubuntu1",
"1.9.7+dfsg-3ubuntu2",
"1.9.7+dfsg-4",
"1.9.7+dfsg-5",
"1.9.7+dfsg-6",
"1.10.0+dfsg-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-33466.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "liborthancframework1",
"binary_version": "1.10.0+dfsg-1"
},
{
"binary_name": "orthanc",
"binary_version": "1.10.0+dfsg-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "orthanc",
"purl": "pkg:deb/ubuntu/orthanc?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"1.12.1+dfsg-3",
"1.12.1+dfsg-4",
"1.12.1+dfsg-4build1",
"1.12.2+dfsg-1",
"1.12.2+dfsg-1build3",
"1.12.2+dfsg-1build4"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-33466.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "liborthancframework1",
"binary_version": "1.12.2+dfsg-1build4"
},
{
"binary_name": "orthanc",
"binary_version": "1.12.2+dfsg-1build4"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "orthanc",
"purl": "pkg:deb/ubuntu/orthanc?arch=source&distro=questing",
"ecosystem": "Ubuntu:25.10"
},
"versions": [
"1.12.6+dfsg-1",
"1.12.7+dfsg-4",
"1.12.7+dfsg-4build2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-33466.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "liborthancframework1",
"binary_version": "1.12.7+dfsg-4build2"
},
{
"binary_name": "orthanc",
"binary_version": "1.12.7+dfsg-4build2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "orthanc",
"purl": "pkg:deb/ubuntu/orthanc?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"1.12.10+dfsg-2",
"1.12.11+dfsg-8",
"1.12.11+dfsg-8build1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-33466.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "liborthancframework1",
"binary_version": "1.12.11+dfsg-8build1"
},
{
"binary_name": "liborthancframework1.12.11",
"binary_version": "1.12.11+dfsg-8build1"
},
{
"binary_name": "orthanc",
"binary_version": "1.12.11+dfsg-8build1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "orthanc",
"purl": "pkg:deb/ubuntu/orthanc?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"1.12.7+dfsg-4build2",
"1.12.9+dfsg-2",
"1.12.10+dfsg-1",
"1.12.10+dfsg-1build1",
"1.12.10+dfsg-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-33466.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "liborthancframework1",
"binary_version": "1.12.10+dfsg-2"
},
{
"binary_name": "orthanc",
"binary_version": "1.12.10+dfsg-2"
}
]
}
}
],
"modified": "2026-10-17T12:57:19.548724030Z",
"provider": "osv",
"upstream": [
"CVE-2023-33466"
],
"references": [
"https://ubuntu.com/security/CVE-2023-33466",
"https://discourse.orthanc-server.org/t/security-advisory-for-orthanc-deployments-running-versions-before-1-12-0/3568",
"https://www.cve.org/CVERecord?id=CVE-2023-33466"
]
},
"related_cves": [
{
"value": "CVE-2023-33466",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 357192,
"published_at": "2023-06-29T15:15:00+00:00"
}