CVE-2026-32711pydicom is a pure Python package for working with DICOM files.
Updated under an hour ago ()
Does this affect you?
It affects pydicom. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
pydicom is a pure Python package for working with DICOM files. Versions 2.0.0-rc.1 through 3.0.1 are vulnerable to Path Traversal through a maliciously crafted DICOMDIR ReferencedFileID when it is set to a path outside the File-set root. pydicom resolves the path only to confirm that it exists, but does not verify that the resolved path remains under the File-set root. Subsequent public FileSet operations such as copy(), write(), and remove()+write(use_existing=True) use that unchecked path in file I/O operations. This allows arbitrary file read/copy and, in some flows, move/delete outside the File-set root. This issue has been fixed in version 3.0.2.
- CVSS
- 7.8 HIGH (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-22
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Not given
- NVD analysis
- Analyzed
- Record last updated
- Jun 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
pydicom pydicom pydicom:pydicom | from 2.0.0 before 3.0.2 | NVD |
References
- https://github.com/pydicom/pydicom/commit/6414f01a053dff925578799f5a7208d2ae585e82patch
- https://github.com/pydicom/pydicom/releases/tag/v3.0.2product, release-notes
- https://github.com/pydicom/pydicom/security/advisories/GHSA-v856-2rf8-9f28exploit, vendor-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.