CVE-2022-2119

9.8 criticalEPSS 3.4%

Critical (9.8) in offis dcmtk. EPSS 3.4% chance of exploitation in the next 30 days.

OFFIS DCMTK's (All versions prior to 3.6.7) service class provider (SCP) is vulnerable to path traversal, allowing an attacker to write DICOM files into arbitrary directories under controlled names. This could allow remote code execution.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 3.4% chance of exploitation in the next 30 days; higher than 88% of CVEs (scores of 2026-10-31)
CWE: CWE-22
Published: 2022-06-24
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

offis:dcmtk

References

https://www.cisa.gov/uscert/ics/advisories/icsma-22-174-01
https://lists.debian.org/debian-lts-announce/2025/06/msg00025.html
https://www.cisa.gov/uscert/ics/advisories/icsma-22-174-01

Check your stack JSON