View at Official debian advisory, NVD, CVE.org · CVE detail
Freshness: upstream tracker timestamp is available; use API updated time as primary recency signal.
CVE-2022-2120 not yet assigned priority: Debian including 1 source packages (dcmtk), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5.
OFFIS DCMTK's (All versions prior to 3.6.7) service class user (SCU) is vulnerable to relative path traversal, allowing an attacker to write DICOM files into arbitrary directories under controlled names. This could allow remote code execution.