CVE catalog
CVE-2023-33466
orthanc: CVE-2023-33466
- Severity
- Medium
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 4.15% · Oct 25, 2026
Orthanc before 1.12.0 allows authenticated users with access to the Orthanc API to overwrite arbitrary files on the file system, and in specific deployment scenarios allows the attacker to overwrite the configuration, which can be exploited to trigger Remote Code Execution (RCE).
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | orthanc | sid | 1.13.0+dfsg-1 | fixed |
| Debian | orthanc | forky | 1.13.0+dfsg-1 | fixed |
| Debian | orthanc | trixie | 1.12.7+dfsg-4 | fixed |
| Debian | orthanc | bookworm | 1.10.1+dfsg-2+deb12u1 | fixed |
| Debian | orthanc | bookworm-security | 1.10.1+dfsg-2+deb12u1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | orthanc | source | sid | 1.12.1+dfsg-1 | not yet assigned | Not reported | [1040597] |
| Debian | orthanc | source | forky | 1.12.1+dfsg-1 | not yet assigned | Not reported | [1040597] |
| Debian | orthanc | source | trixie | 1.12.1+dfsg-1 | not yet assigned | Not reported | [1040597] |
| Debian | orthanc | source | bookworm | 1.10.1+dfsg-2+deb12u1 | not yet assigned | Not reported | [1040597] |
OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.