Path Traversal Vulnerability in WekaClassifier of NLTK by NLTK
CVE-2026-109956

8.3HIGH

Key Information:

Vendor

Nltk

Status
Nltk
Vendor
CVE Published:
13 October 2026

What is CVE-2026-109956?

A path traversal vulnerability in the WekaClassifier component of NLTK versions up to 3.10.3 allows attackers to exploit unvalidated model paths. By manipulating the model_filename or model argument, malicious actors can force the Weka Java Virtual Machine (JVM) to write files or probe outside the designated data directories, posing serious security risks to affected users.

Affected Version(s)

nltk 0 <= 3.10.3

References

https://github.com/nltk/nltk/security/advisories/GHSA-j45...
vendor-advisory
https://www.vulncheck.com/advisories/nltk-through-3.10.3-...
third-party-advisory

CVSS V4

Score:
8.3
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

manus-use
.