CVE-2026-52868

CVE-2026-52868

commit e3878daf870cd2db50eadfde38615f0afae8a584
Author: Michael Onken <onken@open-connections.de>
Date:   Tue May 19 17:16:08 2026 +0200

    Fix path traversal in wlmscpfs through Called AET.

    The wlmscpfs SCP appended the Called Application Entity Title received
    in the A-ASSOCIATE-RQ directly onto the configured worklist data file
    path and used the existence of the resulting directory as an access
    control decision. Because DICOM VR AE permits the characters "/", "\"
    and ".", a peer could send a 16-byte AE title such as "../secret/VICTIM"
    and have wlmscpfs serve worklist records from a sibling directory of
    the configured root. With option --request-file-path enabled, the same
    AE title (and the Patient ID) was substituted into the output filename
    template without sanitization, producing an arbitrary-location write
    primitive outside the configured request file directory.

    This commit closes both holes:

    - wlmscpfs now rejects any A-ASSOCIATE-RQ whose Called AE title is not
      safe to use as a single filesystem path component, refusing the
      association with WLM_BAD_AE_SERVICE. The validation is implemented in
      the new static method WlmFileSystemInteractionManager::IsValidAETitle\
      ForFilesystem, which rejects empty or over-long titles, any title
      containing a dot, and delegates the remaining character check to
      OFStandard::sanitizeAETitle (sanitize-and-compare).

    - The placeholder substitution in storeRequestToFile now passes each
      substituted value (#a, #c, #p) through OFStandard::sanitizeAETitle
      before insertion, and additionally sanitizes the final filename, so
      that any path separator surviving the substitution is defanged.

    Supporting changes:

    - Promote storescp's private sanitizeAETitle helper into the public
      OFStandard::sanitizeAETitle, with documentation noting that the
      function is also used by wlmscpfs to validate filesystem path
      components (so widening the allow list has downstream effects).
    - Replace storescp's local copy of the helper with the new public one.
    - Add a forward declaration of DcmSequenceOfItems in wlfsim.h that
      was previously missing (existing callers happened to include dctk.h
      first).
    - Document the new behaviour in the wlmscpfs man page.

    Tests:

    - New ofstd_OFStandard_sanitizeAETitle test covers the lifted helper
      (path separators, NUL, control bytes, high-range bytes, shell
      metacharacters, the quotation-mark preservation behaviour, and
      empty/length-1 edge cases).
    - New dcmwlm_aetitle_validation test covers the validator directly
      with every path-traversal payload from the bug report ("../secret/\
      VICTIM", "../CARDIOLOGY", "..", ".", "..\secret"), dotted variants
      ("MY.AE", "foo..bar", ".foo", "foo."), structural rejections (empty,
      17 bytes, embedded NUL, tab, 0xFF), shell metacharacters, and a row
      of legitimate AE titles that must still be accepted.
    - dcmwlm previously had no OFTEST scaffolding; tests.cc has been added
      along with the corresponding CMakeLists.txt and Makefile.in entries.

    Thanks to Abhinav Agarwal for the report.

Gbp-Pq: Name CVE-2026-52868.patch