CVE-2026-126296

Name of the Vulnerable Software and Affected Versions NLTK versions prior to 3.10.4

Description An issue exists in the save maxent params() and load maxent params() functions that allows for path traversal, bypassing the pathsec filesystem restriction mechanism. This occurs because the functions call Python's built-in open() directly. An attacker who controls the tab dir variable can read or overwrite model parameter files located outside the permitted data roots.

Recommendations Update NLTK to version 3.10.4 or later. As a temporary mitigation, restrict access to the save maxent params() and load maxent params() functions or ensure the tab dir variable is strictly validated.