CVE-2026-56445

Deferred Deferred - Pending Action

Arbitrary File Write via Unsanitized DICOM Path in qrscp

Publication date: 2026-06-25

Last updated on: 2026-06-26

Assigner: ICS-CERT

Description

The qrscp application's C-STORE handler uses a specific instance from attacker-supplied DICOM datasets directly in os.path.join() without sanitization, allowing file writes to arbitrary paths.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-25

Last Modified

2026-06-26

Generated

2026-07-16

AI Q&A

2026-06-26

EPSS Evaluated

2026-07-14

NVD

CVE-2026-56445

Affected Vendors & Products

Vendor	Product	Version / Range
machine_spirits_ug	csafpid-0001	*
pynetdicom	pynetdicom	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

The vulnerability exists in the qrscp application's C-STORE handler, which processes DICOM datasets. It uses a specific instance from attacker-supplied DICOM data directly in the os.path.join() function without sanitizing the input. This lack of sanitization allows an attacker to write files to arbitrary paths on the system.

Impact Analysis

This vulnerability can allow an attacker to write files to arbitrary locations on the affected system. This can lead to unauthorized file creation or modification, potentially resulting in system compromise, data corruption, or disruption of normal operations.

Compliance Impact

CVE-2026-56445 allows unauthenticated attackers to write to arbitrary file paths, leading to severe system compromise that impacts confidentiality and integrity significantly.

Such a vulnerability could negatively affect compliance with common standards and regulations like GDPR and HIPAA, which require protection of data confidentiality and integrity.

Organizations using the affected software should minimize network exposure, isolate control systems behind firewalls, and use secure remote access methods to mitigate risks and help maintain compliance.

Detection Guidance

There is no specific detection method or commands provided in the available information to identify this vulnerability on your network or system.

Mitigation Strategies

To mitigate this vulnerability, users are advised to minimize network exposure of the affected system and isolate control systems behind firewalls.

Use secure remote access methods such as VPNs to limit unauthorized access.

Follow CISA's recommended practices for industrial control systems security for additional guidance.

Hi! I’m here to help you understand CVE-2026-56445. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70