Arbitrary File Write Vulnerability in `pynetdicom` Library Compromises Data Integrity
The `pynetdicom` library from pydicom is vulnerable to arbitrary file writes due to improper sanitization in its C-STORE handler. This vulnerability, identified as CVE-2026-56445 with a CVSS score of 8.8, affects versions >=v1.0.0 and <v3.0.4. Defenders should immediately update to version 3.0.4 or later to mitigate the risk.
Summary
The pynetdicom library, part of the pydicom suite for handling DICOM networking protocols in Python, has been found vulnerable to arbitrary file writes. This vulnerability stems from the C-STORE handler's misuse of attacker-supplied data within os.path.join(), allowing attackers to write files to any path on the system. The issue affects versions >=v1.0.0 and <v3.0.4, with a CVSS score of 8.8 indicating high severity.
What happened
The vulnerability arises from the C-STORE handler in pynetdicom's qrscp application. It directly uses instances from attacker-supplied DICOM datasets without proper sanitization when constructing file paths using os.path.join(). This oversight allows attackers to manipulate file paths, leading to unauthorized writes to arbitrary locations on the host system.
Affected products and fixed versions
The vulnerability impacts specific versions of the pynetdicom library:
| Product Version Range | Status |
|---|---|
| >=v1.0.0 | Vulnerable |
| <v3.0.4 | Vulnerable |
To mitigate this issue, users should upgrade to version 3.0.4 or later.
Exploitation status
While no public exploitation of this vulnerability has been reported as of the advisory date, the potential for arbitrary file writes poses a significant risk. Attackers could exploit this flaw to overwrite critical files, execute malicious code, or disrupt services.
Detection opportunities
Organizations can detect potential exploitation attempts by monitoring for unusual file write activities in directories typically accessed by pynetdicom. Implementing network traffic analysis tools to inspect DICOM C-STORE requests may also help identify suspicious patterns indicative of an attack.
Defender guidance
-
Update Immediately: Upgrade the
pynetdicomlibrary to version 3.0.4 or later as soon as possible. -
Monitor File Writes: Implement logging and monitoring for file write operations, especially in directories accessed by DICOM applications.
-
Network Traffic Analysis: Use network analysis tools to inspect DICOM traffic for anomalies that may suggest exploitation attempts.
-
Access Controls: Restrict access to critical system directories where
pynetdicomoperates to minimize potential damage from unauthorized writes. -
Regular Security Audits: Conduct regular security audits of all medical imaging software and associated libraries to identify and mitigate vulnerabilities promptly.
What remains unclear
The extent of the vulnerability's exploitation in the wild is not yet confirmed, leaving some uncertainty about its active use by malicious actors. Additionally, specific environments or configurations that might be more susceptible to this flaw have not been fully detailed.
Organizations should remain vigilant and proactive in applying security patches while monitoring for any signs of compromise related to this vulnerability.
Sources
