CVE-2025-58755CWE-22

MONAI has path traversal issue that may lead to arbitrary file writes

High · published September 8, 2025

CVSS v3.1
8.8
EPSS
1%
Percentile
49.3
In the wild
Unconfirmed
What it is

MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. The extractall function `zip_file.extractall(output_dir)` is used directly to process compressed files. It is used in many places in the project. In versions up to and including 1.5.0, when the Zip file containing malicious content is decompressed, it overwrites the system files. In addition, the project allows the download of the zip content through the link, which increases the scope of exploitation of this vulnerability. As of time of publication, no known fixed versions are available.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00623 · 49.3th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-09-08T23:35Z
EPSS history
Timeline
  • 08 SEP 23:35Z
    MONAI has path traversal issue that may lead to arbitrary file writes
    cvelistv5