CVE-2026-56445 Details
Description
The qrscp application's C-STORE handler uses a specific instance from attacker-supplied DICOM datasets directly in os.path.join() without sanitization, allowing file writes to arbitrary paths.
A path traversal vulnerability has been identified in the pydicom pynetdicom library, specifically in the C-STORE handler of the qrscp application. This vulnerability allows an unauthenticated attacker to write files to arbitrary paths on the server. The issue arises because the C-STORE handler processes instances from attacker-supplied DICOM datasets using os.path.join() without proper sanitization, leading to unrestricted file write capabilities.
The maintainer of the pynetdicom library has not responded to requests to collaborate with CISA on addressing this vulnerability. Users are advised to monitor the library's GitHub page for updates.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 25, 2026CISA-ADP
Assessed Jun 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| pydicom pynetdicom | >= 1.0.0, < 3.0.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | CVE Modified | CISA-ADP |
| Jun 25, 2026 | New CVE Received | [email protected] |