PT-2026-26507 · Pydicom · Pydicom

Jh4Nks · Published 2026-03-20 · Updated 2026-03-23 · CVE-2026-32711

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pydicom versions 2.0.0-rc.1 through 3.0.1

Description pydicom is susceptible to a path traversal issue when processing maliciously crafted DICOM files. Specifically, a crafted DICOMDIR can set ReferencedFileID to a path outside the expected File-set root. The software only verifies the existence of the path but does not confirm that it remains within the designated root directory. Subsequent operations like copy(), write(), and remove()+write(use existing=True) then utilize this unchecked path for file I/O, potentially allowing arbitrary file read, copy, move, or deletion outside the intended File-set root. This is due to the lack of a containment check to ensure the resolved path is within the File-set root. A realistic scenario involves a user uploading a malicious DICOM File-set zip, which the server then loads and re-exports, potentially including server-local files referenced by the malicious DICOMDIR in the exported result.

Recommendations Update to pydicom version 3.0.2 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-32711

GHSA-V856-2RF8-9F28

OPENSUSE-SU-2026:10412-1

Affected Products

Pydicom

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32711.json · Exploit
• https://github.com/pydicom/pydicom/commit/6414f01a053dff925578799f5a7208d2ae585e82 · Patch
• https://github.com/pydicom/pydicom/security/advisories/GHSA-v856-2rf8-9f28 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32711 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-32711 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-32711 · Security Note
• https://osv.dev/vulnerability/CVE-2026-32711 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10412-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v856-2rf8-9f28 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-32711 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-32711 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-32711 · Vendor Advisory
• https://github.com/pydicom/pydicom/releases/tag/v3.0.2 · Note
• https://github.com/pydicom/pydicom · Note
• https://suse.com/security/cve/CVE-2026-32711 · Note