File Extraction Vulnerability in MONAI Toolkit for Healthcare Imaging

CVE-2025-58755

What is CVE-2025-58755?

The MONAI toolkit, designed for healthcare imaging, contains a vulnerability in its file extraction functionality. The extractall method in the zip_file class allows the direct extraction of compressed files, making it susceptible to exploitation. When a zip file containing malicious content is processed, it can lead to the unintended overwriting of critical system files. This issue is present in versions up to and including 1.5.0. Furthermore, the functionality permits the downloading of zip content, thereby broadening the potential for exploitation. Currently, no remediation has been published for this vulnerability.

References