Approved changes feed: RSS · Atom
cpe:2.3:a:pydicom:pydicom:*:*:*:*:*:python:*:*
part: a version: * update: *
| Vendor | Pydicom (7005b23b-31a1-5944-a8db-d161c17e6f30) |
|---|---|
| Product | Pydicom (a505d654-73cb-526c-8fc9-73f8d31e5b24) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | python |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/pydicom/pydicom |
purl2cpe | 2026-06-01 10:17:18.145389 |
pkg:pypi/pydicom |
purl2cpe | 2026-06-01 10:17:18.145391 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-32711 |
vulnerable | 2026-06-08 07:57:18.068302 |
pydicom: Path traversal in FileSet/DICOMDIR ReferencedFileID allows file access outside the File-set root
HIGH (7.8)
pydicom is a pure Python package for working with DICOM files. Versions 2.0.0-rc.1 through 3.0.1 are vulnerable to Path Traversal through a maliciously crafted DICOMDIR ReferencedFileID when it is set to a path outside the File-set root. pydicom resolves the path only to confirm that it exists, but does not verify that the resolved path remains under the File-set root. Subsequent public FileSet operations such as copy(), write(), and remove()+write(use_existing=True) use that unchecked path in file I/O operations. This allows arbitrary file read/copy and, in some flows, move/delete outside the File-set root. This issue has been fixed in version 3.0.2.
Published: 2026-03-20T01:26:15.182Z
Updated: 2026-03-20T16:41:56.917Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.