CVE-2023-33466 Path traversal in n/a
Authenticated users can overwrite arbitrary files, potentially leading to remote code execution in specific deployment scenarios.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-33466?
CVE-2023-33466 is a high-severity path traversal vulnerability in n/a, published on 29 Jun 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Orthanc before 1.12.0 allows authenticated users with access to the Orthanc API to overwrite arbitrary files on the file system, and in specific deployment scenarios allows the attacker to overwrite the configuration, which can be exploited to trigger Remote Code Execution (RCE).
Weakness: CWE-94
Which versions are affected by CVE-2023-33466?
It affects 1 product.
Products include Orthanc-Server Orthanc.
How do I fix CVE-2023-33466?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-33466 being exploited?
There is no known exploitation of CVE-2023-33466 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2026-5442 Heap Buffer Overflow in DICOM Image Decoder via VR UL Dimensions
- CVE-2026-5443 Heap Buffer Overflow in DICOM Image Decoder (Palette Color Decode)
- CVE-2025-0896 Orthanc Server Missing Authentication for Critical Function
- CVE-2026-5445 Out-of-Bounds Read in DicomImageDecoder (DecodeLookupTable)
- CVE-2026-5437 Out-of-Bounds Read in DicomStreamReader
Sources
Also known as DEBIAN-CVE-2023-33466, DLA-3562-1, DSA-5473-1, GHSA-f5vv-hcgf-xvxq, UBUNTU-CVE-2023-33466.