PyPI: pydicom
CVE-2026-32711
Safety vulnerability ID: SFTY-20260320-32618
Safety legacy ID: pyup.io-89906
Affected versions of the pydicom package are vulnerable to Path Traversal due to improper validation of ReferencedFileID paths against the File-set root. In src/pydicom/fileset.py, RecordNode._file_id converts ReferencedFileID directly into a Path, FileSet.load() only resolves the path to confirm it exists, and public workflows including FileSet.copy(), FileSet.write(), and remove()+write(use_existing=True) perform file operations without verifying that the resolved path remains inside the intended File-set root.
Overview
pydicom has a path traversal in FileSet/DICOMDIR ReferencedFileID allows file access outside the File-set root
Advisory
Affected versions of the pydicom package are vulnerable to Path Traversal due to improper validation of ReferencedFileID paths against the File-set root. In src/pydicom/fileset.py, RecordNode._file_id converts ReferencedFileID directly into a Path, FileSet.load() only resolves the path to confirm it exists, and public workflows including FileSet.copy(), FileSet.write(), and remove()+write(use_existing=True) perform file operations without verifying that the resolved path remains inside the intended File-set root.
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20260320-32618/CVE-2026-32711
- https://data.safetycli.com/changelogs/pydicom/
- https://github.com/advisories/GHSA-v856-2rf8-9f28
- https://github.com/pydicom/pydicom/commit/6414f01a053dff925578799f5a7208d2ae585e82
- https://pypi.org/project/pydicom
- https://github.com/pydicom/pydicom/security/advisories/GHSA-v856-2rf8-9f28
- https://nvd.nist.gov/vuln/detail/CVE-2026-32711
- https://github.com/pydicom/pydicom/commit/6414f01a053dff925578799f5a7208d2ae585e82
- https://github.com/pydicom/pydicom/releases/tag/v3.0.2
- https://github.com/advisories/GHSA-v856-2rf8-9f28
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more