NLTK up to 3.9.3 path traversal

Summaryinfo

A vulnerability marked as critical has been reported in NLTK up to 3.9.3. This vulnerability affects unknown code. The manipulation leads to path traversal. This vulnerability is listed as CVE-2026-33236. The attack may be initiated remotely. There is no available exploit. It is recommended to apply a patch to fix this issue.

Detailsinfo

A vulnerability was found in NLTK up to 3.9.3. It has been rated as critical. This issue affects an unknown code. The manipulation with an unknown input leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is integrity, and availability. The summary by CVE is:

NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. In versions 3.9.3 and prior, the NLTK downloader does not validate the `subdir` and `id` attributes when processing remote XML index files. Attackers can control a remote XML index server to provide malicious values containing path traversal sequences (such as `../`), which can lead to arbitrary directory creation, arbitrary file creation, and arbitrary file overwrite. Commit 89fe2ec2c6bae6e2e7a46dad65cc34231976ed8a patches the issue.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-33236 since 03/18/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1006 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 303262 (Linux Distros Unpatched Vulnerability : CVE-2026-33236), which helps to determine the existence of the flaw in a target environment.

Applying the patch 89fe2ec2c6bae6e2e7a46dad65cc34231976ed8a is able to eliminate this problem. The bugfix is ready for download at github.com.

The vulnerability is also documented in the databases at Tenable (303262) and CERT Bund (WID-SEC-2026-0895). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• IBM App Connect Enterprise

Productinfo

Name

• NLTK

Version

• 3.9.0
• 3.9.1
• 3.9.2
• 3.9.3

License

• open-source

Website

• Product: https://github.com/nltk/nltk/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion