Vulnerability-Lookup

PYSEC-2026-2266

Vulnerability from pysec - Published: 2026-03-20 02:16 - Updated: 2026-07-13 05:51

Details

pydicom is a pure Python package for working with DICOM files. Versions 2.0.0-rc.1 through 3.0.1 are vulnerable to Path Traversal through a maliciously crafted DICOMDIR ReferencedFileID when it is set to a path outside the File-set root. pydicom resolves the path only to confirm that it exists, but does not verify that the resolved path remains under the File-set root. Subsequent public FileSet operations such as copy(), write(), and remove()+write(use_existing=True) use that unchecked path in file I/O operations. This allows arbitrary file read/copy and, in some flows, move/delete outside the File-set root. This issue has been fixed in version 3.0.2.

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Impacted products

Name	purl
pydicom	pkg:pypi/pydicom

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "PyPI",
        "name": "pydicom",
        "purl": "pkg:pypi/pydicom"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "3.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.0.0",
        "2.1.0",
        "2.1.1",
        "2.1.2",
        "2.2.0",
        "2.2.0rc1",
        "2.2.1",
        "2.2.2",
        "2.3.0",
        "2.3.1",
        "2.4.0",
        "2.4.1",
        "2.4.2",
        "2.4.3",
        "2.4.4",
        "2.4.5",
        "3.0.0",
        "3.0.0rc1",
        "3.0.1"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-32711",
    "GHSA-v856-2rf8-9f28"
  ],
  "details": "pydicom is a pure Python package for working with DICOM files. Versions 2.0.0-rc.1 through 3.0.1 are vulnerable to Path Traversal through a maliciously crafted DICOMDIR ReferencedFileID when it is set to a path outside the File-set root. pydicom resolves the path only to confirm that it exists, but does not verify that the resolved path remains under the File-set root. Subsequent public FileSet operations such as copy(), write(), and remove()+write(use_existing=True) use that unchecked path in file I/O operations. This allows arbitrary file read/copy and, in some flows, move/delete outside the File-set root. This issue has been fixed in version 3.0.2.",
  "id": "PYSEC-2026-2266",
  "modified": "2026-07-13T05:51:02.610583Z",
  "published": "2026-03-20T02:16:33.600Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/pydicom/pydicom/releases/tag/v3.0.2"
    },
    {
      "type": "FIX",
      "url": "https://github.com/pydicom/pydicom/commit/6414f01a053dff925578799f5a7208d2ae585e82"
    },
    {
      "type": "EVIDENCE",
      "url": "https://github.com/pydicom/pydicom/security/advisories/GHSA-v856-2rf8-9f28"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-32711 (GCVE-0-2026-32711)

Vulnerability from cvelistv5 – Published: 2026-03-20 01:26 – Updated: 2026-03-20 16:41

Title

pydicom: Path traversal in FileSet/DICOMDIR ReferencedFileID allows file access outside the File-set root

Summary

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-20 16:41 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/pydicom/pydicom/security/advis…	x_refsource_CONFIRM
https://github.com/pydicom/pydicom/commit/6414f01…	x_refsource_MISC
https://github.com/pydicom/pydicom/releases/tag/v3.0.2	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
pydicom	pydicom	Affected: >= 2.0.0-rc.1, < 3.0.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-32711",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-20T16:41:24.059218Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-20T16:41:56.917Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pydicom",
          "vendor": "pydicom",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.0.0-rc.1, \u003c 3.0.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "pydicom is a pure Python package for working with DICOM files. Versions 2.0.0-rc.1 through 3.0.1 are vulnerable to Path Traversal through a maliciously crafted DICOMDIR ReferencedFileID when it is set to a path outside the File-set root. pydicom resolves the path only to confirm that it exists, but does not verify that the resolved path remains under the File-set root. Subsequent public FileSet operations such as copy(), write(), and remove()+write(use_existing=True) use that unchecked path in file I/O operations. This allows arbitrary file read/copy and, in some flows, move/delete outside the File-set root. This issue has been fixed in version 3.0.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-20T01:26:15.182Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pydicom/pydicom/security/advisories/GHSA-v856-2rf8-9f28",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pydicom/pydicom/security/advisories/GHSA-v856-2rf8-9f28"
        },
        {
          "name": "https://github.com/pydicom/pydicom/commit/6414f01a053dff925578799f5a7208d2ae585e82",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pydicom/pydicom/commit/6414f01a053dff925578799f5a7208d2ae585e82"
        },
        {
          "name": "https://github.com/pydicom/pydicom/releases/tag/v3.0.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pydicom/pydicom/releases/tag/v3.0.2"
        }
      ],
      "source": {
        "advisory": "GHSA-v856-2rf8-9f28",
        "discovery": "UNKNOWN"
      },
      "title": "pydicom: Path traversal in FileSet/DICOMDIR ReferencedFileID allows file access outside the File-set root"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-32711",
    "datePublished": "2026-03-20T01:26:15.182Z",
    "dateReserved": "2026-03-13T14:33:42.824Z",
    "dateUpdated": "2026-03-20T16:41:56.917Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GHSA-V856-2RF8-9F28

Vulnerability from github – Published: 2026-03-20 15:57 – Updated: 2026-03-20 15:57

Summary

pydicom has a path traversal in FileSet/DICOMDIR ReferencedFileID allows file access outside the File-set root

Details

Summary

A crafted DICOMDIR can set ReferencedFileID to a path outside the File-set root. pydicom resolves the path only to confirm that it exists, but does not verify that the resolved path remains under the File-set root. Subsequent public FileSet operations such as copy(), write(), and remove()+write(use_existing=True) use that unchecked path in file I/O operations. This allows arbitrary file read/copy and, in some flows, move/delete outside the File-set root.

Details

Verified on pydicom 3.1.0.dev0.

Relevant logic is in src/pydicom/fileset.py:

RecordNode._file_id converts ReferencedFileID directly to Path(...)
FileSet.load() checks only (root / file_id).resolve(strict=True) to confirm existence
FileSet.load() does not verify that the final resolved path is contained within the File-set root
FileInstance.path returns self.file_set.path / self.node._file_id
FileSet.copy() uses shutil.copyfile(instance.path, dst)
FileSet.write() uses Path(instance.path).unlink() and shutil.move(...)

Because there is no containment check such as resolved.relative_to(root.resolve(strict=True)), a malicious DICOMDIR can reference:

absolute paths such as /etc/passwd
traversal paths such as ../...
syntactically conformant file IDs that escape via symlinks

This is not limited to obviously invalid VR input. Even when pydicom emits warnings for invalid ReferencedFileID values, the operation is not blocked. I also confirmed a symlink-based variant using a conformant file ID.

A realistic server-side scenario is:

a user uploads a DICOM File-set zip
the server loads the uploaded DICOMDIR using FileSet
the server re-exports or reorganizes the File-set using FileSet.copy() or FileSet.write()
a server-local file referenced by the malicious DICOMDIR is included in the exported result

PoC

Minimal reproduction:

Copy a sample File-set that contains a valid DICOMDIR
Modify one DirectoryRecordSequence item so that ReferencedFileID = "/etc/passwd" (or /tmp/secret.txt)
Load it with FileSet(ds) or FileSet(path_to_dicomdir)
Call FileSet.copy(new_root)
Observe that the exported File-set contains the contents of the referenced external file

Example:

from pathlib import Path
from tempfile import mkdtemp
import shutil
from pydicom import dcmread
from pydicom.fileset import FileSet

base = Path("src/pydicom/data/test_files/dicomdirtests")
root = Path(mkdtemp(prefix="fsroot_"))
out = Path(mkdtemp(prefix="fsout_"))

shutil.copy2(base / "DICOMDIR", root / "DICOMDIR")
for d in ("77654033", "98892003", "98892001"):
    shutil.copytree(base / d, root / d)

ds = dcmread(root / "DICOMDIR")
item = next(x for x in ds.DirectoryRecordSequence if "ReferencedFileID" in x)
item.ReferencedFileID = "/etc/passwd"

fs = FileSet(ds)
fs.copy(out)

I also verified the issue in a simple web import/export demo where an uploaded malicious File-set caused /etc/passwd to be copied into the exported result.

If useful, I can provide the exact malicious sample and the demo environment separately.

Impact

This is a path traversal / root containment bypass in FileSet handling.

Observed impact:

arbitrary file read/copy outside the File-set root via FileSet.copy() arbitrary file move outside the File-set root via FileSet.write() arbitrary file delete outside the File-set root via FileSet.remove(...); write(use_existing=True) Affected applications are those that accept untrusted DICOMDIR / File-set input and then call public FileSet workflows such as load(), copy(), write(), or remove().

A realistic impact is server-side file disclosure in import/export workflows.

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.0.1"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "pydicom"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "pydicom"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-32711"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-20T15:57:01Z",
    "nvd_published_at": "2026-03-20T02:16:33Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nA crafted `DICOMDIR` can set `ReferencedFileID` to a path outside the File-set root. `pydicom` resolves the path only to confirm that it exists, but does not verify that the resolved path remains under the File-set root. Subsequent public `FileSet` operations such as `copy()`, `write()`, and `remove()+write(use_existing=True)` use that unchecked path in file I/O operations. This allows arbitrary file read/copy and, in some flows, move/delete outside the File-set root.\n\n### Details\nVerified on `pydicom 3.1.0.dev0`.\n\nRelevant logic is in `src/pydicom/fileset.py`:\n\n- `RecordNode._file_id` converts `ReferencedFileID` directly to `Path(...)`\n- `FileSet.load()` checks only `(root / file_id).resolve(strict=True)` to confirm existence\n- `FileSet.load()` does not verify that the final resolved path is contained within the File-set root\n- `FileInstance.path` returns `self.file_set.path / self.node._file_id`\n- `FileSet.copy()` uses `shutil.copyfile(instance.path, dst)`\n- `FileSet.write()` uses `Path(instance.path).unlink()` and `shutil.move(...)`\n\nBecause there is no containment check such as `resolved.relative_to(root.resolve(strict=True))`, a malicious `DICOMDIR` can reference:\n\n- absolute paths such as `/etc/passwd`\n- traversal paths such as `../...`\n- syntactically conformant file IDs that escape via symlinks\n\nThis is not limited to obviously invalid VR input. Even when `pydicom` emits warnings for invalid `ReferencedFileID` values, the operation is not blocked. I also confirmed a symlink-based variant using a conformant file ID.\n\nA realistic server-side scenario is:\n\n1. a user uploads a DICOM File-set zip\n2. the server loads the uploaded `DICOMDIR` using `FileSet`\n3. the server re-exports or reorganizes the File-set using `FileSet.copy()` or `FileSet.write()`\n4. a server-local file referenced by the malicious `DICOMDIR` is included in the exported result\n\n### PoC\nMinimal reproduction:\n\n1. Copy a sample File-set that contains a valid `DICOMDIR`\n2. Modify one `DirectoryRecordSequence` item so that `ReferencedFileID = \"/etc/passwd\"` (or `/tmp/secret.txt`)\n3. Load it with `FileSet(ds)` or `FileSet(path_to_dicomdir)`\n4. Call `FileSet.copy(new_root)`\n5. Observe that the exported File-set contains the contents of the referenced external file\n\nExample:\n\n```python\nfrom pathlib import Path\nfrom tempfile import mkdtemp\nimport shutil\nfrom pydicom import dcmread\nfrom pydicom.fileset import FileSet\n\nbase = Path(\"src/pydicom/data/test_files/dicomdirtests\")\nroot = Path(mkdtemp(prefix=\"fsroot_\"))\nout = Path(mkdtemp(prefix=\"fsout_\"))\n\nshutil.copy2(base / \"DICOMDIR\", root / \"DICOMDIR\")\nfor d in (\"77654033\", \"98892003\", \"98892001\"):\n    shutil.copytree(base / d, root / d)\n\nds = dcmread(root / \"DICOMDIR\")\nitem = next(x for x in ds.DirectoryRecordSequence if \"ReferencedFileID\" in x)\nitem.ReferencedFileID = \"/etc/passwd\"\n\nfs = FileSet(ds)\nfs.copy(out)\n```\n\nI also verified the issue in a simple web import/export demo where an uploaded malicious File-set caused /etc/passwd to be copied into the exported result.\n\nIf useful, I can provide the exact malicious sample and the demo environment separately.\n\n### Impact\nThis is a path traversal / root containment bypass in FileSet handling.\n\nObserved impact:\n\narbitrary file read/copy outside the File-set root via FileSet.copy()\narbitrary file move outside the File-set root via FileSet.write()\narbitrary file delete outside the File-set root via FileSet.remove(...); write(use_existing=True)\nAffected applications are those that accept untrusted DICOMDIR / File-set input and then call public FileSet workflows such as load(), copy(), write(), or remove().\n\nA realistic impact is server-side file disclosure in import/export workflows.",
  "id": "GHSA-v856-2rf8-9f28",
  "modified": "2026-03-20T15:57:01Z",
  "published": "2026-03-20T15:57:01Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pydicom/pydicom/security/advisories/GHSA-v856-2rf8-9f28"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32711"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pydicom/pydicom/commit/6414f01a053dff925578799f5a7208d2ae585e82"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pydicom/pydicom"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pydicom/pydicom/releases/tag/v3.0.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "pydicom has a path traversal in FileSet/DICOMDIR ReferencedFileID allows file access outside the File-set root"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

PYSEC-2026-2266

CVE-2026-32711 (GCVE-0-2026-32711)

GHSA-V856-2RF8-9F28

Summary

Details

PoC

Impact

Tags

Sightings

Nomenclature

Related by attack behaviour