NLTK up to 3.10.3 Maxent Parameter save_maxent_params/load_maxent_params tab_dir path traversal

Summaryinfo

A vulnerability marked as critical has been reported in NLTK up to 3.10.3. Impacted is the function save_maxent_params/load_maxent_params of the component Maxent Parameter Handler. The manipulation of the argument tab_dir leads to path traversal. This vulnerability is uniquely identified as CVE-2026-126296. The attack is possible to be carried out remotely. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in NLTK up to 3.10.3. This issue affects the function save_maxent_params/load_maxent_params of the component Maxent Parameter Handler. The manipulation of the argument tab_dir with an unknown input leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is integrity, and availability. The summary by CVE is:

NLTK before 3.10.4 contains a path traversal vulnerability in save_maxent_params() and load_maxent_params() that bypasses the pathsec filesystem restriction mechanism. Attackers who control the tab_dir argument can read or overwrite model parameter files outside permitted data roots, because the functions call Python's built-in open() directly.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-126296 since 11/10/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1006 according to MITRE ATT&CK.

Upgrading to version 3.10.4 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• NLTK

Version

• 3.10.0
• 3.10.1
• 3.10.2
• 3.10.3

Website

• Product: https://github.com/nltk/nltk/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion