PyPI/pydicom CVE-2026-32711: high 7.8, EPSS 0.29%
pydicom has a path traversal in FileSet/DICOMDIR ReferencedFileID allows file access outside the File-set root
Action: Upgrade pydicom to 2.4.5 or later.
pip install pydicom==3.0.2pip install pydicom==2.4.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.0.0 | 3.0.2 | - |
| 0 | 2.4.5 | - |
Fixed versions
| 3.0.2 | 2.4.5 |
Sources
- osv: GHSA-v856-2rf8-9f28
- https://github.com/pydicom/pydicom/security/advisories/GHSA-v856-2rf8-9f28
- https://nvd.nist.gov/vuln/detail/CVE-2026-32711
- https://github.com/pydicom/pydicom/commit/6414f01a053dff925578799f5a7208d2ae585e82
- https://github.com/pydicom/pydicom
- https://github.com/pydicom/pydicom/releases/tag/v3.0.2
CVE-2026-32711 · published · modified · JSON