An unauthenticated attacker can read worklist records from a directory outside the intended per-AE worklist storage area, allowing cross‑departmental or clinic data exposure, a clear breach of confidentiality. The flaw is a classic path traversal (CWE‑22) that occurs when the toolkit does not properly validate the requested file path before accessing the file system.

The vulnerability affects the OFFIS DICOM:DCMTK Toolkit. No specific version numbers are provided in the advisory, so all installations are potentially vulnerable until a patch is applied.

The CVSS score of 8.8 marks this flaw as high severity, and although an EPSS score is not available, the lack of an EPSS does not change the inherent risk. The vulnerability is not listed in CISA’s KEV catalog, but the path traversal is exploitable over the network through unauthenticated access to the toolkit’s worklist functionality. Because the flaw allows direct file disclosure, a skilled attacker with network connectivity to the DCMTK service can potentially obtain sensitive patient data from other departments.