High, CVSS 7.8PyPIAmendedPublished
pydicom has a path traversal in FileSet/DICOMDIR ReferencedFileID allows file access outside the File-set root
CVE-2026-32711 · GHSA-v856-2rf8-9f28
- Affected
- PyPI pydicom >= 3.0.0, <= 3.0.1; < 2.4.5
- Fixed in
- 2.4.53.0.2· Vendor fix available
- Issue
- A crafted DICOMDIR can set ReferencedFileID to a path outside the File-set root. pydicom resolves the path only to confirm that it exists, but does not verify that the resolved path remains under the File-set root. Subsequent public FileSet operations such as copy(), write(), and remove()+write(useexisting=True) use that unchecked path in file I/O operations. This allows arbitrary file read/copy and, in some flows, move/delete outside the File-set root. Details Verified on pydicom 3.1.0.dev0. Relevant logic is in src/pydicom/fileset.py: - RecordNode.fileid converts ReferencedFileID directly to Path(...) - FileSet.load() checks only (root / fileid).resolve(strict=True) to confirm existence - FileSet.load() does not verify that the final resolved path is contained within the File-set root - FileInstance.path returns self.fileset.path / self.node.fileid - FileSet.copy() uses shutil.copyfile(instance.path, dst) - FileSet.write() uses Path(instance.path).unlink() and…
Recommended action: Upgrade to 3.0.2 or 2.4.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.