CVE-2025-58755: fallo de gravedad alta en Project-MONAI MONAI
MONAI has path traversal issue that may lead to arbitrary file writes
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.8epss 0.6%
MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. The extractall function `zip_file.extractall(output_dir)` is used directly to process compressed files. It is used in many places in the project. In versions up to and including 1.5.0, when the Zip file containing malicious content is decompressed, it overwrites the system files. In addition, the project allows the download of the zip content through the link, which increases the scope of exploitation of this vulnerability. As of time of publication, no known fixed versions are available.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Productos afectados
Project-MONAI · MONAICVEs relacionadas — Project-MONAI MONAI
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-100844HIGHMONAI before 1.6.0 OS Command Injection via dataset_name_or_idEPSS 0.9%CVE-2025-58756HIGHMONAI's unsafe torch usage may lead to arbitrary code executionEPSS 0.8%CVE-2025-58757HIGHMONAI's unsafe use of Pickle deserialization may lead to RCEEPSS 0.6%CVE-2026-109360HIGHMONAI 0.4.0 before 1.6.1 RCE via SENet Pretrained Weights Over Plaintext HTTPEPSS 0.6%CVE-2026-119578HIGHMONAI 1.6.0 before 1.6.1 Code Execution via Auto3DSeg algo_from_json()EPSS 0.6%CVE-2026-48705CRITICALMONAI: MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass)EPSS 0.5%