CVE-2026-32711

Katalog CVE

CVSS 7.8 · High EPSS 0,22%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada pydicom. Skor CVSS 3.1 7.8 (High) menurut github.com.

Deskripsi (NVD)

pydicom is a pure Python package for working with DICOM files. Versions 2.0.0-rc.1 through 3.0.1 are vulnerable to Path Traversal through a maliciously crafted DICOMDIR ReferencedFileID when it is set to a path outside the File-set root. pydicom resolves the path only to confirm that it exists, but does not verify that the resolved path remains under the File-set root. Subsequent public FileSet operations such as copy(), write(), and remove()+write(use_existing=True) use that unchecked path in file I/O operations. This allows arbitrary file read/copy and, in some flows, move/delete outside the File-set root. This issue has been fixed in version 3.0.2.

Rincian

Terbit di NVD

20 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber github.com
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,22% peluang dieksploitasi; lebih tinggi dari 11,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/pydicom/pydicom/security/advisories/GHSA-v856-2rf8-9f28 exploit · advisory vendor
• https://github.com/pydicom/pydicom/commit/6414f01a053dff925578799f5a7208d2ae585e82 patch
• https://github.com/pydicom/pydicom/releases/tag/v3.0.2 product · release notes