CVE Intelligence
Analysis AI-assisted

CVE-2026-56445: qrscp C-STORE Handler Path Traversal Allowing Arbitrary File Writes

CVE-2026-56445 affects the C-STORE handler of the qrscp application, which uses a value from attacker-supplied DICOM datasets directly in os.path.join() without sanitization, enabling file writes to arbitrary paths (CWE-22). The CNA ICS-CERT assigns CVSS 3.1 9.1 (Critical) and a CVSS 4.0 score of 8.8; the record lists no confirmed exploitation and the CISA KEV catalog does not list it. Affected and fixed versions are not provided in the available record.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-56445 describes a path traversal weakness (CWE-22) in the C-STORE handler of the qrscp application. According to the record, the handler takes a specific instance value from attacker-supplied DICOM datasets and passes it directly to os.path.join() without sanitization, which allows file writes to arbitrary paths. The record was published on 2026-06-25 and its source status is Deferred.

Impact

  • The record's CVSS 3.1 vector indicates network attack vector, low complexity, no privileges and no user interaction required, with high impact on integrity and availability and no impact on confidentiality.
  • The CNA ICS-CERT rates the CVSS 3.1 base score at 9.1 (Critical) and the CVSS 4.0 score at 8.8.
  • Arbitrary file writes can, in general terms, allow an attacker to overwrite or place files outside the intended storage directory. The exact consequences in a given deployment are not described in the record.

Affected products and versions

  • The record names the qrscp application and the pynetdicom project in its references, but does not list affected version ranges.
  • No fixed versions are listed in the record. The absence of fixed versions does not mean no fix exists; it means the record does not provide that information.
  • Administrators should consult the CISA advisory and the CSAF document referenced below for product and version details.

Exploitation status

  • The CISA KEV catalog does not list this CVE in the record.
  • No confirmed exploitation in the wild appears in the sources consulted for this record.

Remediation and mitigation

  • Identify whether qrscp or software embedding its C-STORE handler is deployed in your environment, including medical imaging or DICOM receiving services.
  • Check the CISA advisory ICSMA-26-176-01 and its CSAF file for vendor guidance on updates or workarounds, since the record does not provide them.
  • Until guidance is confirmed, restrict network exposure of DICOM receiving services to trusted sources and limit the write permissions of the service account to only the directories it needs.
  • Run the service with least privilege so that a write outside its intended directory has limited scope.

Detection guidance

  • Review logs of DICOM storage operations for unexpected file names or destination paths outside the configured storage directory.
  • Monitor the storage directory and surrounding filesystem locations for files created or modified by the DICOM service process outside expected paths.
  • Alert on inbound DICOM association activity from unexpected hosts.

Limitations of the available information

  • The record does not list affected or fixed versions, and the affected product set is not confirmed beyond the qrscp and pynetdicom references.
  • The EPSS score and SSVC data are not available in the record.
  • The advisory text linked from CISA and the CSAF file were not reviewed in full for this analysis; details beyond the record are unknown.

Frequently asked questions

What is CVE-2026-56445?

It is a path traversal weakness (CWE-22) in the C-STORE handler of the qrscp application that can allow file writes to arbitrary paths via attacker-supplied DICOM data.

Is this CVE known to be exploited?

No confirmed exploitation appears in the sources consulted, and the CISA KEV catalog does not list this CVE in the record.

Which versions are affected or fixed?

The record does not list affected or fixed versions. Consult the CISA advisory ICSMA-26-176-01 and its CSAF file for vendor details.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.