CVE-2026-21851: MONAI Path Traversal Vulnerability

CVE-2026-21851 Overview

CVE-2026-21851 is a Path Traversal vulnerability, commonly known as "Zip Slip," affecting MONAI (Medical Open Network for AI), an open-source AI toolkit designed for healthcare imaging applications. The vulnerability exists in MONAI's _download_from_ngc_private() function, which uses zipfile.ZipFile.extractall() without proper path validation. This oversight allows attackers to potentially write files to arbitrary locations outside the intended extraction directory when processing maliciously crafted ZIP archives.

Critical Impact
Attackers could exploit this vulnerability to overwrite critical system files or application configurations by crafting malicious ZIP archives with path traversal sequences, potentially compromising the integrity of healthcare AI systems processing medical imaging data.

Affected Products

MONAI (Medical Open Network for AI) versions up to and including 1.5.1
Systems utilizing the NGC private bundle download functionality
Healthcare imaging environments deploying vulnerable MONAI versions

Discovery Timeline

2026-01-07 - CVE CVE-2026-21851 published to NVD
2026-01-08 - Last updated in NVD database

Technical Details for CVE-2026-21851

Vulnerability Analysis

The vulnerability stems from inconsistent security practices within the MONAI codebase. While several download functions in the project properly implement the safe_extract_member() function to validate extracted file paths, the _download_from_ngc_private() function bypasses this protection by directly calling zipfile.ZipFile.extractall(). This creates a Zip Slip vulnerability (CWE-22) where specially crafted ZIP archives containing entries with directory traversal sequences (e.g., ../../../etc/passwd) can write files outside the intended extraction directory.

The attack requires user interaction, as a victim must download and process a malicious archive from an attacker-controlled or compromised NGC private source. Successful exploitation could result in arbitrary file writes, potentially leading to configuration tampering, code injection via overwritten application files, or system compromise depending on the application's runtime privileges.

Root Cause

The root cause is the use of Python's zipfile.ZipFile.extractall() method without implementing path validation to ensure extracted files remain within the designated extraction directory. The MONAI codebase already contained a safe_extract_member() function designed specifically to prevent this type of attack, but it was not utilized in the _download_from_ngc_private() function, creating an inconsistent security posture.

Attack Vector

An attacker could exploit this vulnerability by:

Creating a malicious ZIP archive containing files with path traversal sequences in their names
Hosting the archive on a compromised or malicious NGC private endpoint
Enticing a victim to download a bundle from this source using the vulnerable function
Upon extraction, files would be written to arbitrary locations on the victim's filesystem

The patch addresses this by removing the direct use of the zipfile module in the vulnerable function:

python

 import re
 import urllib
 import warnings
-import zipfile
 from collections.abc import Mapping, Sequence
 from functools import partial
 from pathlib import Path

Source: GitHub Commit Update

Detection Methods for CVE-2026-21851

Indicators of Compromise

Unexpected file modifications outside of MONAI's designated bundle extraction directories
Files appearing in system directories that match naming patterns of medical imaging bundles
Log entries showing bundle downloads from untrusted or unexpected NGC sources
Evidence of path traversal sequences (../) in application logs or extracted file paths

Detection Strategies

Monitor file system activity during MONAI bundle download operations for writes outside expected directories
Implement application-level logging to track all NGC private bundle download operations
Use file integrity monitoring (FIM) on critical system files and configuration directories
Review network traffic for connections to suspicious or unauthorized NGC endpoints

Monitoring Recommendations

Enable comprehensive logging for all MONAI bundle operations in healthcare imaging environments
Implement alerts for file writes to sensitive system directories during bundle extraction
Regularly audit MONAI configurations to verify trusted NGC source endpoints
Deploy endpoint detection and response (EDR) solutions to monitor for suspicious file system activity

How to Mitigate CVE-2026-21851

Immediate Actions Required

Update MONAI to a version containing commit 4014c8475626f20f158921ae0cf98ed259ae4d59 or later
Audit existing systems for evidence of exploitation by checking for unexpected files outside bundle directories
Review and validate all configured NGC private bundle sources for legitimacy
Restrict MONAI application permissions to minimize the impact of potential file write attacks

Patch Information

The vulnerability has been addressed in commit 4014c8475626f20f158921ae0cf98ed259ae4d59. Organizations should update to the latest MONAI version that includes this fix. For detailed information about the security fix, refer to the GitHub Security Advisory GHSA-9rg3-9pvr-6p27 and the security patch commit.

Workarounds

Avoid using the NGC private bundle download functionality until patched
Download bundles manually and verify archive contents before extraction
Implement network-level controls to restrict connections to trusted NGC endpoints only
Run MONAI applications with least-privilege principles to limit the impact of file write attacks

bash

# Verify MONAI version and check for vulnerability
pip show monai | grep Version

# Update to latest patched version
pip install --upgrade monai

# Alternative: Install directly from the patched commit
pip install git+https://github.com/Project-MONAI/MONAI.git@4014c8475626f20f158921ae0cf98ed259ae4d59