CriticalFix available
dcmtk — security advisory
OFFIS DCMTK's (All versions prior to 3.6.7) service class user (SCU) is vulnerable to relative path traversal, allowing an attacker to write DICOM files into arbitrary directories under controlled names. This could allow remote code execution.
- Products
- dcmtk
- Affected versions
- Not specified
- Fixed versions
- 3.6.7-6
- CVEs
- CVE-2022-2120
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 30 Oct 2026, 14:36 UTC · Revision 1
Source evidence
OFFIS DCMTK's (All versions prior to 3.6.7) service class user (SCU) is vulnerable to relative path traversal, allowing an attacker to write DICOM files into arbitrary directories under controlled names. This could allow remote code execution.
osv:DEBIAN-CVE-2022-2120
dcmtk
Fixed versions: 3.6.7-6
dcmtk
Fixed versions: 3.6.7-6
dcmtk
Fixed versions: 3.6.7-6
Complete source record
{
"id": "79ff3e531ef5fb5c213914b464a9e46b7b6237f13a88dc18160d976323b3cc6f",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2022-2120",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2022-2120",
"summary": "OFFIS DCMTK's (All versions prior to 3.6.7) service class user (SCU) is vulnerable to relative path traversal, allowing an attacker to write DICOM files into arbitrary directories under controlled names. This could allow remote code execution.",
"evidence": "osv:DEBIAN-CVE-2022-2120",
"products": [
{
"name": {
"value": "dcmtk",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.6.7-6",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "dcmtk",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.6.7-6",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "dcmtk",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.6.7-6",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "critical",
"structured": {
"id": "DEBIAN-CVE-2022-2120",
"aliases": [
"DEBIAN-CVE-2022-2120"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.6.7-6"
}
]
}
],
"package": {
"name": "dcmtk",
"purl": "pkg:deb/debian/dcmtk?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-2120.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.6.7-6"
}
]
}
],
"package": {
"name": "dcmtk",
"purl": "pkg:deb/debian/dcmtk?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-2120.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.6.7-6"
}
]
}
],
"package": {
"name": "dcmtk",
"purl": "pkg:deb/debian/dcmtk?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-2120.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-15T08:00:56.597908897Z",
"provider": "osv",
"upstream": [
"CVE-2022-2120"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2022-2120"
]
},
"related_cves": [
{
"value": "CVE-2022-2120",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 322716,
"published_at": "2022-06-24T15:15:10.743+00:00"
}