CVE-2026-32711 Details
Description
pydicom is a pure Python package for working with DICOM files. Versions 2.0.0-rc.1 through 3.0.1 are vulnerable to Path Traversal through a maliciously crafted DICOMDIR ReferencedFileID when it is set to a path outside the File-set root. pydicom resolves the path only to confirm that it exists, but does not verify that the resolved path remains under the File-set root. Subsequent public FileSet operations such as copy(), write(), and remove()+write(use_existing=True) use that unchecked path in file I/O operations. This allows arbitrary file read/copy and, in some flows, move/delete outside the File-set root. This issue has been fixed in version 3.0.2.
A path traversal vulnerability has been identified in the pydicom library, specifically in versions 2.0.0-rc.1 through 3.0.1. The issue arises when a crafted DICOMDIR file sets the ReferencedFileID to a path outside the File-set root. pydicom only verifies the existence of the path without ensuring it remains within the File-set boundaries. This oversight allows subsequent FileSet operations, such as copy, write, and remove combined with write(use_existing=True), to access or manipulate files outside the intended directory, potentially leading to unauthorized file read, copy, move, or delete actions.
Users can upgrade to pydicom version 3.0.2, which addresses this vulnerability by adding checks to ensure that ReferencedFileID paths remain within the File-set root before allowing file operations.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pydicom/pydicom/commit/6414f01a053dff925578799f5a7208d2ae585e82 | [email protected] | Patch |
| https://github.com/pydicom/pydicom/releases/tag/v3.0.2 | [email protected] | ProductRelease Notes |
| https://github.com/pydicom/pydicom/security/advisories/GHSA-v856-2rf8-9f28 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| pydicom pydicom | >= 2.0.0, < 3.0.2 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 23, 2026 | Initial Analysis | [email protected] |
| Mar 20, 2026 | New CVE Received | [email protected] |