CVE-2026-109956
Fixed in a distro release EPSS <1%CVSS 7.0
NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass nltk.pathsec containment by supplying unvalidated model paths. Attackers controlling the model_filename or model argument can make the weka JVM write files via -d or probe files via -l outside allowed data roots.
Products: nltk
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | py3-nltk | 3.10.4-r0 |
| Chainguard | py3.11-nltk | 3.10.4-r0 |
| Chainguard | py3.12-nltk | 3.10.4-r0 |
| Chainguard | py3.13-nltk | 3.10.4-r0 |
| Debian 12 | nltk | no fix |
| Debian 13 | nltk | no fix |
| Debian 14 | nltk | no fix |
| Ubuntu 26.10 | nltk | no fix |
| Ubuntu Pro 14.04 LTS | nltk | no fix |
| Ubuntu Pro 16.04 LTS | nltk | no fix |
| Ubuntu Pro 18.04 LTS | nltk | no fix |
| Ubuntu Pro 20.04 LTS | nltk | no fix |
| Ubuntu Pro 22.04 LTS | nltk | no fix |
| Ubuntu Pro 24.04 LTS | nltk | no fix |
| Ubuntu Pro 26.04 LTS | nltk | no fix |
| Wolfi | py3-nltk | 3.10.4-r0 |
| Wolfi | py3.11-nltk | 3.10.4-r0 |
| Wolfi | py3.12-nltk | 3.10.4-r0 |
| Wolfi | py3.13-nltk | 3.10.4-r0 |