CVE-2025-53912

HIGH

An arbitrary file read vulnerability exists in the encapsulatedDoc functionality of MedDream PACS Premium 7.3.6.870. A specially crafted HTTP request can lead to an arbitrary file read. An attacker...

Affects 1 product across 1 vendor.

CVSS 3.18.1
EPSS0.6%
Percentile49th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, low privileges required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, no availability impact.
CWE Weakness Definitions
CWE-73: CWE-73
Related Attack Patterns (CAPEC)
CAPEC-13 Subverting Environment Variable Values
via CWE-73
CAPEC-64 Using Slashes and URL Encoding Combined to Bypass Validation Logic
via CWE-73
CAPEC-72 URL Encoding
via CWE-73
CAPEC-76 Manipulating Web Input to File System Calls
via CWE-73
CAPEC-78 Using Escaped Slashes in Alternate Encoding
via CWE-73
Show all 8
via CWE-73
via CWE-73
via CWE-73

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

An arbitrary file read vulnerability exists in the encapsulatedDoc functionality of MedDream PACS Premium 7.3.6.870, allowing attackers to read arbitrary files on the server via a specially crafted HTTP request.

BSID: BS-2026-GLOBAL-277602-H • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2025-53912?
An arbitrary file read vulnerability exists in the encapsulatedDoc functionality of MedDream PACS Premium 7.3.6.870, allowing attackers to read arbitrary files on the server via a specially crafted HTTP request.
What is the CVSS score for CVE-2025-53912?
CVE-2025-53912 has CVSS 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS: 0.6%.
Is CVE-2025-53912 actively exploited?
No confirmed active exploitation of CVE-2025-53912 as of 2026-05-30.
How do I remediate CVE-2025-53912?
Priority: IMMEDIATE.
What systems are affected by CVE-2025-53912?
CVE-2025-53912 affects Meddream Pacs Server.
Vulnerability Details
CVE IDCVE-2025-53912
BSIDBS-2026-GLOBAL-277602-H BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Published2026-01-20
Last Modified2026-01-29
ICS Relevance0%
Weakness (CWE)
CWE-73
SourceNVD
Official Description

An arbitrary file read vulnerability exists in the encapsulatedDoc functionality of MedDream PACS Premium 7.3.6.870. A specially crafted HTTP request can lead to an arbitrary file read. An attacker can send http request to trigger this vulnerability.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker can exploit this vulnerability by sending a specially crafted HTTP request to the encapsulatedDoc functionality of the affected MedDream PACS Premium version. This can lead to unauthorized access to sensitive files on the server.

Exploitation Likelihood: HIGH

Affected Products
VendorProductAffected Versions
Meddream Pacs Server 7.3.6.870
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 268 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hashbbcdb617f4262830cdcfeb9e2d82d6aadbe69b8394b77dbd4206f622a50b22a0c4029daf9c49652385baed3ff4fb432c7ea8577519c043739ecacb9e965ce8d5
Related CVEs affecting Meddream
CVE-2025-27724 9.8 A privilege escalation vulnerability exists in the login.php functionality of... CVE-2025-3484 9.8 MedDream PACS Server DICOM File Parsing Stack-based Buffer Overflow Remote Co... CVE-2025-26469 9.8 An incorrect default permissions vulnerability exists in the CServerSettings:... CVE-2020-37009 8.8 MedDream PACS Server 6.8.3.751 contains an authenticated remote code executio... CVE-2025-3482 7.8 MedDream PACS Server DICOM File Parsing Stack-based Buffer Overflow Remote Co...
View all Meddream CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →