CVE-2026-32711: pydicom Path Traversal Vulnerability in FileSet/DICOMDIR
Summary
CVE-2026-32711: A crafted DICOMDIR can set ReferencedFileID to a path outside the File-set root. Affects pydicom across 2 version ranges.
< 2.4.5
>= 3.0.0, < 3.0.2
Fixed in 2.4.5 or 3.0.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pydicom is a Python package designed for working with DICOM files, which are used in medical imaging. It allows users to read, write, and manipulate DICOM files easily. The package is widely utilized in healthcare applications for managing medical images. However, a vulnerability exists in the way pydicom handles file paths in its FileSet operations, specifically when processing DICOMDIR files.
Vulnerability Detail
The vulnerability arises from a path traversal issue in the FileSet/DICOMDIR handling of pydicom. A crafted DICOMDIR can set the ReferencedFileID to a path outside the File-set root. pydicom only checks if the path exists without ensuring it remains within the File-set root. This oversight allows attackers to perform arbitrary file read, copy, move, or delete operations outside the intended directory, potentially leading to sensitive file exposure or data loss.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.52.4.5pip install --upgrade "pydicom==2.4.5" -
>= 3.0.0, < 3.0.23.0.2pip install --upgrade "pydicom==3.0.2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid processing untrusted DICOMDIR files. Ensure that any DICOMDIR files you handle are from trusted sources and do not contain malicious ReferencedFileID values.
Conclusion
The pydicom package has a significant vulnerability related to path traversal in its FileSet/DICOMDIR handling. Users are strongly advised to update to the latest version to mitigate risks associated with arbitrary file access. Additionally, employing best practices for file handling can further enhance security.
See every vulnerability recorded for pydicom →
FAQ
The CVSS score of this vulnerability is 7.8, indicating a high severity level.
Versions of pydicom prior to 3.0.2 and those below 2.4.5 are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to check if your application is affected without any signup.
The potential impacts include arbitrary file read, copy, move, or delete operations outside the File-set root, leading to sensitive data exposure or loss.
Yes, you can mitigate the risk by avoiding the use of untrusted DICOMDIR files and ensuring that any files processed are from trusted sources.
References
Related vulnerabilities
Recent vulnerabilities recorded for pydicom.
