CVE-2026-109956
NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass nltk.pathsec containment by supplying unvalidated model paths.
Published Oct 13, 2026 · updated Oct 14, 2026
NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass nltk.pathsec containment by supplying unvalidated model paths. Attackers controlling the model_filename or model argument can make the weka JVM write files via -d or probe files via -l outside allowed data roots.
Timeline
Detection, updates, and resolution for this record.
Oct 13, 2026 · OSV.dev
Detected
NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass nltk.pathsec containment by supplying unvalidated model paths. Attackers controlling the model_filename or model argument can make the weka JVM write files via -d or probe files via -l outside allowed data roots.
Oct 14, 2026 · OSV.dev
Updated
NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass nltk.pathsec containment by supplying unvalidated model paths. Attackers controlling the model_filename or model argument can make the weka JVM write files via -d or probe files via -l outside allowed data roots.
Affected
- Debian:12 nltk3.10.0-1, 3.10.1-1, 3.10.3-1
- Debian:13 nltk3.10.0-1, 3.10.1-1, 3.10.3-1
- Debian:14 nltk3.10.0-1, 3.10.1-1, 3.10.3-1