Path Traversal Vulnerability in MONAI AI Toolkit for Healthcare Imaging
CVE-2026-21851

5.3MEDIUM

Key Information:

Vendor

Project-monai

Status
Monai
Vendor
CVE Published:
7 January 2026

What is CVE-2026-21851?

A Path Traversal vulnerability was identified in the _download_from_ngc_private() function of the MONAI AI toolkit for healthcare imaging. This issue arises when the function utilizes zipfile.ZipFile.extractall() without sufficient path validation, potentially allowing attackers to overwrite arbitrary files during extraction. Unlike other download functions in the codebase that utilize the safe_extract_member() function, this oversight in the mentioned function can lead to significant security risks in systems using MONAI. A fix has been implemented in commit 4014c8475626f20f158921ae0cf98ed259ae4d59.

Affected Version(s)

MONAI <= 1.5.1

References

https://github.com/Project-MONAI/MONAI/security/advisorie...
x_refsource_CONFIRM
https://github.com/Project-MONAI/MONAI/commit/4014c847562...
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.