dcm4chee-arc-light Storage API Flaw Enables Silent Data Deletion

The J4Care dcm4chee-arc-light medical imaging archive contains a critical vulnerability that permits the unintended deletion of stored diagnostic data. According to the National Vulnerability Database, the issue stems from a logic error in the storage status-change REST service. This flaw allows an attacker to manipulate location records associated with active DICOM instances, forcing the system to remove the underlying files from physical storage without removing the corresponding metadata from the database.

Root cause

The vulnerability, identified as CVE-2026-97851, is classified as a critical severity issue with a CVSS score of 9.1. It maps to CWE-862, which covers improper validation of array indices or similar logic errors. The core problem lies in how the application handles state changes for storage locations. The system permits location records that are still linked to valid DICOM instances to be updated into deletion-related states. This bypasses expected safeguards that should prevent the removal of data still referenced by the archive’s primary index.

Attack path

An attacker with access to the storage status-change REST service can exploit this weakness by targeting specific location records. By changing the status of a location to TO_DELETE, the attacker triggers the background PurgeStorageScheduler process. This scheduler is designed to clean up storage, but in this scenario, it acts on the manipulated state. It deletes the referenced object from the file system or object store. Crucially, the corresponding instance record remains in the database, creating a discrepancy where the system believes data exists but the actual file is gone.

Affected versions

The vulnerability impacts the following specific release of the software:

• J4Care dcm4chee-arc-light version 5.35.1

Mitigation

No official patch or fix has been confirmed for this vulnerability yet. Organizations running the affected version should treat this as a high-priority risk. Until a vendor update is available, teams should restrict access to the storage status-change REST service to trusted administrative interfaces only. Implementing strict network segmentation can also limit exposure to unauthorized API calls that could trigger the deletion logic.

Signals worth monitoring

Teams usually detect this type of logic abuse by correlating API logs with storage audit trails. Look for REST API calls that change location states to deletion values for records that remain active in the database. Monitor the PurgeStorageScheduler logs for deletion events that do not match corresponding database cleanup actions. Check for orphaned database entries where the file system path returns a missing error. Immediate containment involves isolating the API endpoint and verifying the integrity of the storage backend against the database index.

What to do and how to stay safe: dcm4chee-arc-light

• Restrict network access to the dcm4chee-arc-light REST API endpoints to only trusted management subnets.
• Enable detailed logging on all storage state-change requests to track who or what is modifying location records.
• Implement file integrity monitoring on the storage backend to alert on unexpected deletions of DICOM files.
• Review database consistency regularly to identify instances where metadata exists but the referenced file is missing.

Step-by-step guide: Attack Surface Management: 6 Common Misreadings and Correct Views

General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-97851?

The National Vulnerability Database rates CVE-2026-97851 as a critical severity issue with a CVSS score of 9.1.

Which version of dcm4chee-arc-light is affected?

The vulnerability affects J4Care dcm4chee-arc-light version 5.35.1.

Does a patch exist for this vulnerability?

No fix has been confirmed yet.