What is the CVSS score of EUVD-2026-13433?

EUVD-2026-13433 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Python are affected by EUVD-2026-13433?

A critical vulnerability in pydicom (versions 2.0.0-rc.1 through 3.0.1) allows attackers to read, modify, or delete arbitrary files on systems that process malicious DICOM medical imaging files.. A patch is available.

How to fix or mitigate EUVD-2026-13433?

Within 24 hours: Identify all systems and applications using pydicom through software inventory and dependency scanning; restrict file-opening permissions to trusted users only. Within 7 days: Implement network segmentation to isolate systems processing DICOM files; disable pydicom functionality if non-critical; establish monitoring for suspicious file access patterns. Within 30 days: Migrate to alternative DICOM libraries if available; evaluate vendor patches when released; conduct forensic review of DICOM files processed in the past 90 days for indicators of compromise.

Python EUVD-2026-13433

| CVE-2026-32711 HIGH

Path Traversal (CWE-22)

2026-03-20 security-advisories@github.com

GHSA-v856-2rf8-9f28

Python Path Traversal Suse

7.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 20, 2026 - 08:37 euvd

EUVD-2026-13433

Analysis Generated

Mar 20, 2026 - 08:37 vuln.today

CVE Published

Mar 20, 2026 - 02:16 nvd

HIGH 7.8

DescriptionGitHub Advisory

pydicom is a pure Python package for working with DICOM files. Versions 2.0.0-rc.1 through 3.0.1 are vulnerable to Path Traversal through a maliciously crafted DICOMDIR ReferencedFileID when it is set to a path outside the File-set root. pydicom resolves the path only to confirm that it exists, but does not verify that the resolved path remains under the File-set root. Subsequent public FileSet operations such as copy(), write(), and remove()+write(use_existing=True) use that unchecked path in file I/O operations. This allows arbitrary file read/copy and, in some flows, move/delete outside the File-set root. This issue has been fixed in version 3.0.2.

AnalysisAI

Path traversal in pydicom versions 2.0.0-rc.1 through 3.0.1 allows local attackers to read, copy, or delete arbitrary files outside the File-set root directory by crafting malicious ReferencedFileID values in DICOMDIR files. The vulnerability exists because pydicom fails to validate that resolved file paths remain within the intended File-set root before performing file I/O operations like copy(), write(), and remove(). No patch is currently available for affected versions.

Technical ContextAI

pydicom is a pure Python library used extensively in medical imaging systems for parsing and manipulating DICOM (Digital Imaging and Communications in Medicine) files. This vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as path traversal. The issue occurs in the DICOMDIR file handling logic where pydicom resolves the ReferencedFileID path to verify existence but fails to validate that the resolved path remains within the intended File-set root directory boundary. When FileSet methods like copy(), write(), or remove() with write(use_existing=True) are subsequently invoked, they perform file I/O operations using the unvalidated path, allowing directory traversal attacks using sequences like '../' to access files outside the intended scope.

RemediationAI

Upgrade pydicom to version 3.0.2 or later, which contains the fix for this path traversal vulnerability as documented in the release at https://github.com/pydicom/pydicom/releases/tag/v3.0.2. The specific patch commit is available at https://github.com/pydicom/pydicom/commit/6414f01a053dff925578799f5a7208d2ae585e82 for review. Until patching is possible, implement strict input validation on DICOMDIR files by only accepting files from trusted sources, scanning for path traversal patterns in ReferencedFileID fields before processing, and running pydicom operations in sandboxed environments with restricted file system access to limit potential damage from malicious files.