pydicom hat eine Pfadüberschreitung in FileSet/DICOMDIR ReferencedFileID, die den Zugriff auf Dateien außerhalb des File-set-Wurzelverzeichnisses ermöglicht

The core of the vulnerability lies in how pydicom handles ReferencedFileID within a DICOMDIR file. A malicious actor can craft a DICOMDIR where this ID points to a path outside the designated File-set root. While pydicom performs a check to confirm the existence of the resolved path, it fails to verify that the path remains within the intended boundaries. Subsequent operations, such as copying, writing, and removing files (with use_existing=True), then utilize this unchecked path for file I/O, leading to unauthorized access and manipulation of files on the system. This could result in sensitive data exposure, system compromise, or denial of service depending on the permissions of the process running pydicom.

Systems utilizing pydicom for DICOM file processing, particularly those handling patient data or medical imaging archives, are at risk. Applications that dynamically construct file paths based on user-supplied data or external inputs are especially vulnerable. Environments with limited access controls or inadequate input validation practices face a higher risk of exploitation.

• python / library:

import os
import pydicom

def check_file_path(dicom_dir_path, file_set_root):
    try:
        ds = pydicom.dcmread(dicom_dir_path)
        referenced_file_id = ds.ReferencedFileID.value
        resolved_path = os.path.join(file_set_root, referenced_file_id)
        if not resolved_path.startswith(file_set_root):
            print(f"Potential Path Traversal: Resolved path {resolved_path} is outside the File-set root.")
        else:
            print("Path is within the File-set root.")
    except Exception as e:
        print(f"Error processing DICOMDIR: {e}")

# Example usage (replace with actual paths)
file_set_root = "/path/to/fileset"
dicom_dir_path = "/path/to/malicious_dicomdir.xml"
check_file_path(dicom_dir_path, file_set_root)

1. 2026-03-20Discovery

   disclosure

1. Reserviert2026-03-13
2. Veröffentlicht2026-03-20
3. EPSS aktualisiert2026-03-27

The primary mitigation for CVE-2026-32711 is to upgrade to pydicom version 3.0.2 or later, which includes the necessary fix. If upgrading is not immediately feasible, consider implementing stricter file access controls to limit the permissions of the process running pydicom. Additionally, input validation on DICOMDIR files can help prevent the injection of malicious ReferencedFileID values. While a WAF is unlikely to directly address this vulnerability, it could be configured to monitor for unusual file access patterns. After upgrading, confirm the fix by attempting to create a DICOMDIR with a ReferencedFileID pointing outside the File-set root and verifying that the operation is rejected.