CVE-2026-109956High· 7.0▾ MidnightPoC availableNLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass nltk.pathsec containment by supplying unvalidated model paths. Attackers controlling the model_filename or model argument can m…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 38.5 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 15.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Exploit / PoC code exists
NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass nltk.pathsec containment by supplying unvalidated model paths. Attackers controlling the model_filename or model argument can make the weka JVM write files via -d or probe files via -l outside allowed data roots.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
nltk < 3.10.4Patched in:
nltk 3.10.4Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-78679Medium· 6.5GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create() where a positional reference parameter bypasses the unsafe option guard
CVE-2026-79676Medium· 5.9nltk: NLTK: Information disclosure via path traversal with symlink bypass (CVE-2026-79676)
CVE-2026-73619Medium· 6.5gitpython: GitPython: Arbitrary file read vulnerability via `Repo.archive()` (CVE-2026-73619)
CVE-2026-114140High· 7.8nbconvert: nbconvert: arbitrary file write via path traversal in ExtractOutputPreprocessor (CVE-2026-114140)
CVE-2026-114109High· 7.8uv: uv: Arbitrary code execution via path traversal in entry point names (CVE-2026-114109)
CVE-2026-80206Medium· 5.9nltk: NLTK: Denial of Service vulnerability in tgrep module (CVE-2026-80206)