CVE-2026-109956

Name of the Vulnerable Software and Affected Versions NLTK versions prior to 3.10.4

Description A path traversal issue exists in the WekaClassifier. The component fails to validate the model filename or model arguments, allowing the bypass of nltk.pathsec containment. An attacker can provide malicious paths and Weka arguments to the spawned Weka JVM to write files using the -d flag or probe files using the -l flag outside of the permitted data roots.

Recommendations Update NLTK to version 3.10.4 or later. Restrict the use of the model filename and model parameters in WekaClassifier to trusted paths only.