CVE Daily

CVE-2018-25113

An unauthenticated path traversal vulnerability exists in Dicoogle PACS Web Serv...

High CVSS 8.7

Overview

An unauthenticated path traversal vulnerability exists in Dicoogle PACS Web Server version 2.5.0 and possibly earlier. The vulnerability allows remote attackers to read arbitrary files on the underlying system by sending a crafted request to the /exportFile endpoint using the UID parameter. Successful exploitation can reveal sensitive files accessible by the web server user.

CWE: CWE-22 Published: 2025-07-23T14:15:32.300
Risk analysis

This vulnerability is rated 🟠 HIGH.

  • CVSS: 8.7 (HIGH)
  • Detected tags: path (tag impact: MODERATE)

Recommended actions:

  • Canonicalize path; block `..` traversal; use allowlists.

Recommended tools

Tags