A path traversal vulnerability in the pydicom library allows an attacker to perform unauthorized file operations on the host system, posing a significant risk to data integrity and system security.

The library fails to properly validate the ReferencedFileID within DICOMDIR files, enabling path traversal. Attackers can trigger arbitrary file read, copy, move, or delete operations when the application processes a maliciously crafted DICOM file, even without prior authentication (local access required per CVSS vector).

The exploitation of this vulnerability could lead to the unauthorized disclosure of sensitive medical imaging data or the destruction of critical system files. With a CVSS score of 7.8, this flaw represents a High severity risk, particularly in healthcare environments where DICOM files are processed automatically. Successful exploitation may result in system instability, data loss, or non-compliance with data privacy regulations.

Immediate Action: Update the pydicom library to version 3.0.2 or 2.4.5 immediately to incorporate the necessary path validation fixes.

Proactive Monitoring: Review application logs for unexpected file system access patterns or errors related to DICOMDIR processing, particularly those involving file paths containing directory traversal sequences.

Compensating Controls: Implement strict file system permissions for the user account running the pydicom service to limit the impact of potential directory traversal to only the necessary directories.

Public Exploit Available: Unknown.

Given the potential for arbitrary file deletion and sensitive data access, organizations utilizing pydicom must prioritize patching to the latest stable versions. Immediate verification of software dependencies and the application of the provided updates are essential to maintain the security and integrity of medical imaging workflows.