CVE-2026-109956 in NLTK
Summary
by MITRE • 10/13/2026
NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass nltk.pathsec containment by supplying unvalidated model paths. Attackers controlling the model_filename or model argument can make the weka JVM write files via -d or probe files via -l outside allowed data roots.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/13/2026
The Natural Language Toolkit, commonly known as NLTK, is a widely used Python library for symbolic and statistical natural language processing that integrates with various machine learning libraries including Weka. In versions of NLTK up to 3.10.3, the implementation of the WekaClassifier interface contains a critical path traversal vulnerability within its model loading mechanism. This flaw arises because the classifier does not adequately validate or sanitize the file paths provided by users when instantiating models via the model_filename or model arguments. The security design relies on nltk.pathsec to restrict access to specific data roots, ensuring that external resources remain confined to authorized directories. However, this containment measure is bypassed entirely due to insufficient input validation before the path is passed to the underlying Weka Java Virtual Machine environment.
The technical root cause of this vulnerability lies in how NLTK constructs and executes commands or passes arguments to the Weka JVM. When an attacker controls the model_filename parameter, they can supply a file path containing directory traversal sequences such as ../ or absolute paths that point outside the permitted data roots. Because the application fails to normalize these paths against the allowed base directories before processing them, it allows the system to access arbitrary locations on the host filesystem. This lack of strict boundary enforcement means that any relative or absolute path provided by an untrusted source is treated as valid without verification against a whitelist of safe directories.
The operational impact of this vulnerability is severe and multifaceted depending on the context in which NLTK is deployed. If the application allows attackers to control the model argument, they can exploit the -d flag supported by certain Weka classifiers to write arbitrary files to the filesystem. This capability enables remote code execution if an attacker can place a malicious script or executable in a location that is subsequently executed by the system. Alternatively, even without file writing capabilities, the ability to probe files via the -l flag allows for sensitive information disclosure. Attackers can read configuration files, source code, credentials, or other private data stored outside the intended application directories, leading to significant confidentiality breaches and potential pivoting into deeper network infrastructure.
This vulnerability aligns with CWE-22 Improper Limitation of a Pathname to a Restricted Directory, as it involves failing to restrict access to resources based on user input. Furthermore, from an offensive security perspective, this behavior maps directly to the ATT&CK technique T1083 File and Directory Discovery, where adversaries probe the system for sensitive information, and potentially T1564 Hidden Files and Directories if used in conjunction with other techniques to obscure malicious artifacts. The exploitation of this flaw does not require authentication in many default configurations or scenarios where user-supplied model paths are accepted from external sources such as web forms or API endpoints.
To mitigate this vulnerability, organizations must upgrade NLTK to version 3.10.4 or later where the path validation logic has been strengthened. In environments where upgrading is not immediately feasible, developers should implement strict input sanitization by ensuring that all model paths are resolved to their absolute canonical form and verified against a predefined list of allowed base directories before being passed to the Weka classifier. Additionally, running applications with minimal file system permissions can limit the impact if an attacker succeeds in writing files outside the intended scope. Regular security audits focusing on external resource loading mechanisms are essential to prevent similar path traversal issues across other components that interact with external libraries and JVM-based processes.