PyPI/pydicom CVE-2026-32711: high 7.8, EPSS 0.29%
pydicom is a pure Python package for working with DICOM files. Versions 2.0.0-rc.1 through 3.0.1 are vulnerable to Path Traversal through a maliciously crafted DICOMDIR ReferencedFileID when it is set
Action: Upgrade pydicom to 3.0.2 or later.
pip install pydicom==3.0.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.0.0 | 3.0.2 | - |
Fixed versions
| 3.0.2 |
Sources
- osv: PYSEC-2026-2266
- https://github.com/pydicom/pydicom/releases/tag/v3.0.2
- https://github.com/pydicom/pydicom/commit/6414f01a053dff925578799f5a7208d2ae585e82
- https://github.com/pydicom/pydicom/security/advisories/GHSA-v856-2rf8-9f28
CVE-2026-32711 · published · modified · JSON