CVE-2026-21851: MONAI Path Traversal Vulnerability

CVE-2026-21851 Overview

CVE-2026-21851 is a Path Traversal vulnerability, commonly known as "Zip Slip," affecting MONAI (Medical Open Network for AI), an open-source AI toolkit designed for healthcare imaging applications. The vulnerability exists in MONAI's _download_from_ngc_private() function, which uses zipfile.ZipFile.extractall() without proper path validation. This oversight allows attackers to potentially write files to arbitrary locations outside the intended extraction directory when processing maliciously crafted ZIP archives.

Critical Impact

Attackers could exploit this vulnerability to overwrite critical system files or application configurations by crafting malicious ZIP archives with path traversal sequences, potentially compromising the integrity of healthcare AI systems processing medical imaging data.

Affected Products

• MONAI (Medical Open Network for AI) versions up to and including 1.5.1
• Systems utilizing the NGC private bundle download functionality
• Healthcare imaging environments deploying vulnerable MONAI versions

Discovery Timeline

• 2026-01-07 - CVE CVE-2026-21851 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2026-21851

Vulnerability Analysis

The vulnerability stems from inconsistent security practices within the MONAI codebase. While several download functions in the project properly implement the safe_extract_member() function to validate extracted file paths, the _download_from_ngc_private() function bypasses this protection by directly calling zipfile.ZipFile.extractall(). This creates a Zip Slip vulnerability (CWE-22) where specially crafted ZIP archives containing entries with directory traversal sequences (e.g., ../../../etc/passwd) can write files outside the intended extraction directory.

The attack requires user interaction, as a victim must download and process a malicious archive from an attacker-controlled or compromised NGC private source. Successful exploitation could result in arbitrary file writes, potentially leading to configuration tampering, code injection via overwritten application files, or system compromise depending on the application's runtime privileges.

Root Cause

The root cause is the use of Python's zipfile.ZipFile.extractall() method without implementing path validation to ensure extracted files remain within the designated extraction directory. The MONAI codebase already contained a safe_extract_member() function designed specifically to prevent this type of attack, but it was not utilized in the _download_from_ngc_private() function, creating an inconsistent security posture.

Attack Vector

An attacker could exploit this vulnerability by:

1. Creating a malicious ZIP archive containing files with path traversal sequences in their names
2. Hosting the archive on a compromised or malicious NGC private endpoint
3. Enticing a victim to download a bundle from this source using the vulnerable function
4. Upon extraction, files would be written to arbitrary locations on the victim's filesystem

The patch addresses this by removing the direct use of the zipfile module in the vulnerable function:

 import re
 import urllib
 import warnings
-import zipfile
 from collections.abc import Mapping, Sequence
 from functools import partial
 from pathlib import Path

Source: GitHub Commit Update

Detection Methods for CVE-2026-21851

Indicators of Compromise

• Unexpected file modifications outside of MONAI's designated bundle extraction directories
• Files appearing in system directories that match naming patterns of medical imaging bundles
• Log entries showing bundle downloads from untrusted or unexpected NGC sources
• Evidence of path traversal sequences (../) in application logs or extracted file paths

Detection Strategies

• Monitor file system activity during MONAI bundle download operations for writes outside expected directories
• Implement application-level logging to track all NGC private bundle download operations
• Use file integrity monitoring (FIM) on critical system files and configuration directories
• Review network traffic for connections to suspicious or unauthorized NGC endpoints

Monitoring Recommendations

• Enable comprehensive logging for all MONAI bundle operations in healthcare imaging environments
• Implement alerts for file writes to sensitive system directories during bundle extraction
• Regularly audit MONAI configurations to verify trusted NGC source endpoints
• Deploy endpoint detection and response (EDR) solutions to monitor for suspicious file system activity

How to Mitigate CVE-2026-21851

Immediate Actions Required

• Update MONAI to a version containing commit 4014c8475626f20f158921ae0cf98ed259ae4d59 or later
• Audit existing systems for evidence of exploitation by checking for unexpected files outside bundle directories
• Review and validate all configured NGC private bundle sources for legitimacy
• Restrict MONAI application permissions to minimize the impact of potential file write attacks

Patch Information

The vulnerability has been addressed in commit 4014c8475626f20f158921ae0cf98ed259ae4d59. Organizations should update to the latest MONAI version that includes this fix. For detailed information about the security fix, refer to the GitHub Security Advisory GHSA-9rg3-9pvr-6p27 and the security patch commit.

Workarounds

• Avoid using the NGC private bundle download functionality until patched
• Download bundles manually and verify archive contents before extraction
• Implement network-level controls to restrict connections to trusted NGC endpoints only
• Run MONAI applications with least-privilege principles to limit the impact of file write attacks

# Verify MONAI version and check for vulnerability
pip show monai | grep Version

# Update to latest patched version
pip install --upgrade monai

# Alternative: Install directly from the patched commit
pip install git+https://github.com/Project-MONAI/MONAI.git@4014c8475626f20f158921ae0cf98ed259ae4d59