Executive brief
A vulnerability exists in the pynetdicom library, which is used for medical imaging communications (DICOM) in healthcare environments. An unauthenticated attacker can remotely send specially crafted medical data to the qrscp application to overwrite critical system files. This could lead to a complete loss of system integrity, potential service outages, or unauthorized access to the underlying server.
Technical details
The qrscp application's C-STORE handler within the pynetdicom library is vulnerable to a path traversal (CWE-22) flaw. The root cause is the direct use of attacker-supplied DICOM dataset instances in the os.path.join() function without proper sanitization. An unauthenticated remote attacker can exploit this by sending a malicious DICOM dataset, leading to arbitrary file writes on the host system. This can result in the corruption of system files or the placement of malicious executables. The vulnerability affects versions 1.0.0 through 3.0.3; users are advised to check the project's GitHub for updates as the maintainer has not officially coordinated a fix with CISA.
Affected products
- pydicom pynetdicom Library >=1.0.0, <3.0.4
Timeline
- 2026-06-25: advisory: CISA published ICSMA-26-176-01 and NVD published CVE-2026-56445