VulnSocial

CVE-2026-109956

LOWCVSS 8.3 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass nltk.pathsec containment by supplying unvalidated model paths. Attackers controlling the model_filename or model argument can make the weka JVM write files via -d or probe files via -l outside allowed data roots.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-22

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-10-13: 110-13
Full discourse1 post
  • Upwind Security MDR@UpwindMDR

    🚨High - NLTK WekaClassifier Path Traversal via model path (CVE-2026-109956) NLTK WekaClassifier fails to validate model_filename/model paths, letting attacker-supplied paths bypass nltk.pathsec containment. By passing traversal and Weka args, the spawned Weka JVM can write arbitrary files via -d or probe/read paths via -l outside allowed data roots. 👉Affected: nltk <= 3.10.3

    0000040
    319 followersView on X

Explore more

Back to dashboard