CVE-2026-126296: NLTK before 3.10.4 Path Traversal via save_maxent_params and load_maxent_params
NLTK before 3.10.4 contains a path traversal vulnerability in savemaxentparams() and loadmaxentparams() that bypasses the pathsec filesystem restriction mechanism. Attackers who control the tabdir argument can read or overwrite model parameter files outside permitted data roots, because the functions call Python's built-in open() directly.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nltkto a version that resolves this vulnerability.Fixed in 3.10.4
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using NLTK versions before 3.10.4 are exposed if an attacker can control the tab_dir argument passed to save_maxent_params() or load_maxent_params(). The issue is remotely reachable only where that attacker-controlled input can be supplied through the application.
What access does an attacker need?
The attacker does not need prior privileges or user interaction, but exploitation requires control of the tab_dir argument. Exploitation has high attack complexity.
What can an attacker do?
An attacker can use path traversal to read or overwrite model parameter files outside the permitted data roots. The reported impact is limited to integrity and availability; confidentiality impact is listed as none.
How can I determine whether my deployment is affected?
Check whether the application uses an NLTK release before 3.10.4 and calls save_maxent_params() or load_maxent_params(). Review whether untrusted or externally influenced values can reach their tab_dir argument.