The qrscp application’s C‑STORE handler copies an attacker‑supplied path from a DICOM dataset into os.path.join() without sanitization, allowing the attacker to craft a file name that resolves to any filesystem location. This flaw is a classic path‑traversal weakness (CWE‑22) and enables the creation or overwriting of arbitrary files on the host. The consequence is a severe breach of confidentiality, integrity, or availability if critical files are targeted.

Products affected are the pydicom and pynetdicom libraries that implement the version information is provided, implying that all releases containing this code path may be vulnerable and should be evaluated for the presence of the flaw.

The CVSS score of 8.8 assigns this vulnerability to high severity. The EPSS score is not available and the flaw is not listed in CISA’s KEV catalog, suggesting a moderate exploitation probability, but the potential impact remains significant. Likely attack vectors involve a remote, possibly untrusted, DICOM client that can send a specially crafted dataset to the target service, requiring the C‑STORE endpoint to be reachable from an external network.