Pydicom vulnerabilities
We track 2 vulnerabilities in Pydicom products across 2 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on June 25, 2026.
2vulnerabilities
1critical
1high
0exploited
8.4average CVSS score
Latest Pydicom vulnerabilities
- 9.1 Critical severity
pynetdicom Library: Improper Limitation of a Pathname to a Restricted Directory
The qrscp application's C-STORE handler uses a specific instance from attacker-supplied DICOM datasets directly in os.path.join() without sanitization, allowing file writes to arbitrary paths.
- 7.8 High severity
pydicom: Improper Limitation of a Pathname to a Restricted Directory
pydicom is a pure Python package for working with DICOM files. Versions 2.0.0-rc.1 through 3.0.1 are vulnerable to Path Traversal through a maliciously crafted DICOMDIR ReferencedFileID when it is set to a path outside the File-set root. pydicom resolves the p