High priorityDisclosed

Advisory · CVE-2026-109956

NLTK WekaClassifier model paths can escape their allowed roots

NLTK through 3.10.3 does not validate WekaClassifier model paths well enough, so a crafted model path can escape its containment and write or probe files outside the allowed roots. VulnCheck rates it CVSS 4.0 8.3 (CVSS 3.1 7.0).

Advisory published October 13, 2026Independent summary
Vendor
NLTK
Product
NLTK
Identifier / CWE
CVE-2026-109956
CWE-22
Action timing
Immediate
ELI5

Explain it like I’m five

A Python NLP library that loads a model by path can be handed a path that wanders out of the model folder and into the rest of the file system.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Crafted model path

    An attacker supplies a model file whose path contains traversal elements.

  2. 02Path trusted

    NLTK's WekaClassifier handling uses the path without adequate validation.

  3. 03Escape lands

    Files outside the intended root can be written or probed.

What happened

NLTK disclosed CVE-2026-109956 for the WekaClassifier component: model paths are not validated against their allowed roots, so traversal sequences can escape containment in NLTK releases through 3.10.3.

No fixed release is stated in the NVD record. Until the project ships one, treat model files as untrusted input: load only models from sources you control and sandbox jobs that process third-party models.

What to do

  1. Inventory every NLTK deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to NLTK while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for model files or paths containing traversal sequences, and NLP jobs writing files outside their working directories.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

Data-science pipelines load model files casually. This is a reminder to treat them like code: provenance first, sandbox always.