ZeroDay Findings
Sign inSign up

Findings

CVE-2026-109956

NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass nltk.pathsec containment by supplying unvalidated model paths.

Published Oct 13, 2026 · updated Oct 14, 2026

NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass nltk.pathsec containment by supplying unvalidated model paths. Attackers controlling the model_filename or model argument can make the weka JVM write files via -d or probe files via -l outside allowed data roots.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 13, 2026 · OSV.dev

    Detected

    NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass nltk.pathsec containment by supplying unvalidated model paths. Attackers controlling the model_filename or model argument can make the weka JVM write files via -d or probe files via -l outside allowed data roots.

  2. Oct 14, 2026 · OSV.dev

    Updated

    NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass nltk.pathsec containment by supplying unvalidated model paths. Attackers controlling the model_filename or model argument can make the weka JVM write files via -d or probe files via -l outside allowed data roots.

Affected

  • Debian:12 nltk3.10.0-1, 3.10.1-1, 3.10.3-1
  • Debian:13 nltk3.10.0-1, 3.10.1-1, 3.10.3-1
  • Debian:14 nltk3.10.0-1, 3.10.1-1, 3.10.3-1

Sources

References