CVE-2026-109956 is a High severity (CVSS 7.0) path traversal in NLTK through 3.10.3. WekaClassifier passes caller supplied model paths to the weka JVM without the pathsec checks used elsewhere. The GitHub advisory lists no patched version, so check the project for a fix and validate paths yourself.
What's affected
The record says NLTK through 3.10.3 is affected. The GitHub advisory for the pip package nltk lists affected versions as 3.10.3 and earlier and says patched versions are none. Because the advisory names no fix, we cannot name a safe version here. Check the NLTK releases and the advisory for updates before you rely on any number.
The weakness is CWE-22, path traversal. According to the advisory, NLTK added a path containment module, nltk.pathsec, to keep model file paths inside allowed data roots, but WekaClassifier does not use it. The model_filename given to train, and the model path given when classifying, go straight to the weka Java process. That allows a file to be written outside the allowed roots when training and a file to be probed when classifying.
Severity differs between sources. The record gives 7.0 (High). VulnCheck lists 8.3, High. Both agree on High.
How to check if you're exposed
List the installed NLTK version.
pip show nltk
Then search your code for the weka wrapper. If you never import the classifier, you are not exposed through this path.
grep -rn "WekaClassifier" .
The risk depends on whether untrusted input can reach the model path argument. A notebook where a data scientist types a fixed filename is a different situation from a service that builds the path from a request field or an uploaded file name. The free in-browser dependency scan at gold.safeguard.sh/scan can match a manifest or lockfile against known CVEs without installing anything.
What to do now
- Find every project that installs NLTK and check whether it calls WekaClassifier.
- If it does, stop passing user controlled values as the model filename or model path. Use a fixed directory and a server chosen file name.
- Resolve and check the final path against an allowed directory before calling the classifier, and reject anything that leaves it.
- Run the weka process with a low privilege account and a filesystem that only allows writes where needed.
- Watch the NLTK advisory and releases and upgrade as soon as a patched version is published.
Why it matters
Path traversal bugs happen when code builds a file path from input and trusts it. NLTK had already addressed the same class in other functions under an earlier advisory, and this one is described as a code path that fix never touched. Fixing a pattern in some call sites and missing others is a common way for a weakness to survive.
The advisory frames this as a risk for workflows that handle untrusted model paths, not for every NLTK user. For most teams the real exposure is small, but the fix is simple to apply on your side: never let outside input choose where a model is written or read. The record does not mark this CVE as known exploited, and none of the pages we read say it is.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a patched NLTK version?
The GitHub advisory lists patched versions as none at the time we read it. Check the advisory again before you plan an upgrade.
Does this affect every NLTK install?
No. The advisory describes the weka classifier wrapper only. If your code does not use WekaClassifier, this path is not reachable.
Sources
Last reviewed: 18 October 2026.
