PT-2025-36531 · Monai · Monai

H3Rrr · Published 2025-09-08 · Updated 2025-09-14 · CVE-2025-58755

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: MONAI versions prior to 1.5.1

Description: MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. The extractall function zip file.extractall(output dir) is used directly to process compressed files throughout the project. When processing a Zip file containing malicious content, the function overwrites system files. The project also allows downloading of zip content, increasing the scope of exploitation.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-58755

GHSA-X6WW-PF9M-M73M

PYSEC-2025-140

Affected Products

Monai

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58755.json · Exploit
• https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-x6ww-pf9m-m73m · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2025-140 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-58755 · Security Note
• https://osv.dev/vulnerability/GHSA-x6ww-pf9m-m73m · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-58755 · Vendor Advisory
• https://github.com/Project-MONAI/MONAI · Note
• https://github.com/Project-MONAI/MONAI/pull/8568 · Note
• https://github.com/Project-MONAI/MONAI/commit/946cfdff096d8b1d289063f06a04cae3fa3559d9 · Note
• https://t.me/CVEtracker/32010 · Telegram Post
• https://twitter.com/BaseFortify/status/1965354251892523072 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1965220859154493615 · Twitter Post
• https://t.me/cveNotify/134725 · Telegram Post
• https://twitter.com/cracbot/status/1967181575663333807 · Twitter Post
• https://twitter.com/CVEnew/status/1965201134886236643 · Twitter Post