CISA 2026-06-25

pydicom pynetdicom Library

CVE-2026-56445

Machine-generated analysis · WAYSCloud LLM

The vulnerability stems from unsanitized use of attacker-supplied data in file path operations within the qrscp application's C-STORE handler.

Context

The pydicom pynetdicom Library is a Python implementation for handling DICOM network communications, used in healthcare environments for medical imaging workflows. The advisory states that CVE-2026-56445 allows unauthenticated attackers to perform path traversal due to unsanitized input in os.path.join() within the qrscp C-STORE handler. This could result in arbitrary file writes on the target system. Notably, the vendor has not responded to CISA's outreach, and no official patch is available.

Operator considerations

Check: Inventory systems using pynetdicom in versions >=v1.0.0 and <v3.0.4, particularly those exposing qrscp services. Log: Monitor file system access logs for unexpected writes originating from processes running pynetdicom applications. Patch: No official vendor patch is available; monitor the project's GitHub repository for updates.

From Cybersecurity and Infrastructure Security Agency ↗

Successful exploitation of this vulnerability could allow an unauthenticated attacker to write to arbitrary file paths.

The following versions of pydicom pynetdicom Library are affected:

pynetdicom >=v1.0.0|

Read the full advisory on CISA →