Unrestricted file upload on a PACS points straight at code execution

MedDevice Cyber Staff · Apr 10 · 2 min read · Via CISA

INFINITT PACS System Manager, versions 3.0.11.5 BN9 and prior, got ICSMA-25-100-01. Two unrestricted file-upload flaws, CVE-2025-27714 and CVE-2025-24489, plus an information-exposure bug, CVE-2025-27721 at 7.5. Piotr Kijewski of the Shadowserver Foundation reported them.

An unrestricted file upload is a failure to answer a simple question about incoming data, not just whether the server accepts a file but what it does with it afterward. Upload features are common in clinical web software because studies, reports and bundles all move as files, and the validation meant to gate them is easy to write too loosely. When the checks look only at a declared type and never at content or storage location, an attacker can hand the server something it will later treat as code.

Unrestricted upload is a direct line to code execution. Put an executable where the server will run it and the imaging archive is yours, and the info-exposure bug hands you reconnaissance to go with the foothold. A PACS holds every image, every study, every identifier a radiology department has.

Code execution on that server is not a contained event. A PACS is the hub the imaging devices feed and the reading rooms pull from, so an intruder who owns it can watch, copy or quietly change images that clinicians will read as ground truth. The same position that exposes records can also degrade availability, and a radiology department that cannot trust or reach its archive is one that slows toward a stop.

Validate what gets uploaded, type and extension and content, and never store an upload where the web server will execute it. This bug class is old and it still owns servers.

The report came through an outside researcher and a coordinated advisory, the path that surfaces these bugs before an incident does. What the case marks is the persistence of a long-standing web weakness on the machine that anchors medical imaging. File-upload flaws keep landing on clinical servers because the software around them was built to move medical files first and to distrust them second.

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

INFINITT PACS System Manager had two unrestricted file-upload flaws pointing at remote code execution plus an information-exposure bug, on the server that holds the imaging archive (ICSMA-25-100-01). Apply the fix and constrain uploads by type, location and execution.

Apply the vendor fix. Update INFINITT PACS System Manager to the remediated version from ICSMA-25-100-01.
Constrain uploads. Validate file type and content, store uploads outside the web root, and never let an uploaded file execute.
Segment the archive server. Keep the PACS server off any segment that does not need it, since it holds the imaging archive.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the properties below. Check them against your product to gauge exposure.

Required

app_file_upload app_database

Contributing

app_web_ui net_wired net_remote_access data_phi use_hospital_net sys_ots_software

EMB3D

PID-311 PID-3231

Fix the class in your product

The server accepts an uploaded file and lets it execute. As the maker, validate type by content, store uploads under a server-generated name in a non-executable location outside the web root, and serve them back through a handler that never interprets them.

Validate by content. Check magic bytes, not the extension; cap size and scan on ingest.
Store inert and non-executable. Server-generated name, no-exec directory, outside the web root.
Never execute an upload. Serve through a handler that returns bytes, never interprets them.

Mapped EMB3D mitigations

Questions & Answers

What was found in INFINITT PACS System Manager?

ICSMA-25-100-01 covers versions 3.0.11.5 BN9 and prior: two unrestricted file-upload flaws, CVE-2025-27714 and CVE-2025-24489, plus an information-exposure bug, CVE-2025-27721 at 7.5. Piotr Kijewski of the Shadowserver Foundation reported them.

What does unrestricted file upload mean for a PACS?

An attacker who can place an executable where the server will run it takes the imaging archive, which holds every image, study and identifier a radiology department has. Uploads need type, extension and content validation, stored where the web server cannot execute them.

← Back to Vulnerabilities