CVE-2025-58755: MONAI Path Traversal Vulnerability

CVE-2025-58755 Overview

CVE-2025-58755 is a path traversal vulnerability [CWE-22] in MONAI (Medical Open Network for AI), an open-source AI toolkit for healthcare imaging. The flaw exists in the project's archive handling code, where zip_file.extractall(output_dir) is called directly on untrusted Zip archives. An attacker who supplies a crafted Zip file can write files outside the intended extraction directory and overwrite arbitrary files on the host. MONAI also supports downloading Zip content from remote URLs, which widens the exploitable surface to network-based attackers. Versions up to and including 1.5.0 are affected, and no fixed version is available at the time of publication.

Critical Impact
A remote attacker with low privileges can overwrite system files on hosts running MONAI workflows, leading to integrity loss and potential code execution in healthcare imaging environments.

Affected Products

MONAI (Medical Open Network for AI) versions up to and including 1.5.0
Project-MONAI monai Python package using zip_file.extractall
Downstream pipelines that consume MONAI's remote Zip download utilities

Discovery Timeline

2025-09-09 - CVE-2025-58755 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58755

Vulnerability Analysis

The vulnerability is a classic Zip Slip path traversal issue. MONAI uses Python's zipfile.ZipFile.extractall(output_dir) to decompress archives across multiple modules. The extractall method does not sanitize entry names containing .. sequences or absolute paths. An archive crafted with entries such as ../../../../etc/cron.d/payload causes files to be written outside output_dir when extracted.

MONAI compounds the risk by allowing archives to be fetched from attacker-controlled URLs through its dataset and model download helpers. A user who triggers a download or processes an untrusted archive can have host files overwritten under the privileges of the running process. In containerized inference or training environments, this can lead to overwriting Python site-packages, startup scripts, or model files used by downstream pipelines.

Root Cause

The root cause is the direct invocation of zip_file.extractall(output_dir) without validating that resolved member paths remain within output_dir. Python's standard library does not enforce containment, so traversal sequences in archive entries are honored during extraction.

Attack Vector

The attack vector is network-based with low privileges and no user interaction. An attacker hosts a malicious Zip archive at a URL referenced by a MONAI workflow, or supplies the archive directly to a MONAI extraction routine. When MONAI extracts the archive, traversal entries overwrite files outside the target directory. Refer to the MONAI GitHub Security Advisory GHSA-x6ww-pf9m-m73m for additional technical details.

Detection Methods for CVE-2025-58755

Indicators of Compromise

Files written outside expected MONAI dataset or cache directories such as ~/.cache/monai or user-specified output_dir paths
Archive entries whose normalized paths contain .. segments or absolute paths observed in MONAI logs
Unexpected modifications to Python site-packages, cron directories, SSH authorized_keys, or shell startup files on hosts running MONAI
Outbound network connections from MONAI processes to untrusted hosts serving Zip archives

Detection Strategies

Audit Python code for direct calls to ZipFile.extractall on archives sourced from network locations or user input
Monitor process file-write activity originating from python interpreters loading the monai module and flag writes outside the configured extraction directory
Inspect downloaded .zip files with a pre-extraction listing step and reject any entry whose resolved path escapes the target directory

Monitoring Recommendations

Enable file integrity monitoring on system directories, Python environments, and MONAI cache paths
Log all URLs passed to MONAI's download utilities and alert on domains not on an allow list
Capture command-line and file-system telemetry from MONAI training and inference containers for offline review

How to Mitigate CVE-2025-58755

Immediate Actions Required

Avoid processing Zip archives from untrusted sources with MONAI versions up to 1.5.0
Restrict MONAI workloads to non-privileged service accounts and isolated containers to limit the blast radius of arbitrary file writes
Replace direct extractall calls in local forks with a safe extraction routine that validates each member path against the target directory
Block egress from MONAI hosts to unapproved domains hosting model or dataset archives

Patch Information

As of the time of publication, no fixed version of MONAI is available. Track the Project-MONAI security advisory GHSA-x6ww-pf9m-m73m for fix availability and upgrade as soon as a patched release is published.

Workarounds

Wrap MONAI extraction calls with a guard that resolves each archive member with os.path.realpath and rejects paths outside the destination directory
Pre-scan archives with zipfile.ZipFile.namelist() and abort extraction if any entry begins with / or contains ..
Run MONAI workflows inside read-only or ephemeral filesystems so that overwritten files do not persist across runs

bash

# Configuration example: pre-validate archive entries before extraction
python - <<'PY'
import os, zipfile, sys
archive, dest = sys.argv[1], os.path.abspath(sys.argv[2])
with zipfile.ZipFile(archive) as zf:
    for name in zf.namelist():
        target = os.path.abspath(os.path.join(dest, name))
        if not target.startswith(dest + os.sep):
            raise SystemExit(f"Unsafe entry detected: {name}")
    zf.extractall(dest)
PY