Zero Radar
← feed
HighVulnerabilityGHSA-j456-xh4h-cpf2updated 27 Oct 2026, 14:51 UTC

NLTK's Weka classifier can read and write model files outside allowed folders

A Python language tool called NLTK can be tricked into saving or loading a model file in any folder on the computer, even folders it should block. If the file path comes from untrusted input, an attacker can write files to unexpected places

Fixed in nltk 3.10.4Official source
SeverityHighCVSS 8.6 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yesnltk 3.10.4 · since 27 Oct 2026
How sure is this?Official sourceBacked by an official source

What happened

In NLTK, WekaClassifier passes a caller-supplied model path directly to the Java-based Weka tool (-d for write, -l for read) without the path validation that other NLTK tool wrappers use, bypassing NLTK's pathsec containment.

Why it is dangerous: If an application lets untrusted users choose the Weka model path, they can write files to arbitrary locations or make the Weka process read and parse arbitrary files, possibly leading to data overwrite or information exposure on the server.

Are you affected?

You are affected if you use NLTK's WekaClassifier (pip package nltk up to 3.10.3) and any part of the model file path comes from untrusted users or workflows.

Package / productAffected versionsFixed in
nltk · pip<= 3.10.33.10.4

What to do

  1. Update nltk to 3.10.4 or later
  2. Until updated, do not pass user-controlled values as Weka model file paths
  3. Restrict the process running NLTK to only the folders it needs

Timeline

  1. 27 Oct 2026, 14:50 UTC
    Publicly disclosed
  2. 27 Oct 2026, 14:50 UTC
    Reported by GitHub Advisory · GitHub Advisory
  3. 27 Oct 2026, 14:51 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
GHSA-j456-xh4h-cpf2
CVSS
8.6 / 10
Disclosed
27 Oct 2026, 14:50 UTC
On Zero Radar
27 Oct 2026, 14:51 UTC (1 min after disclosure)
Last change
27 Oct 2026, 14:51 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

NLTK's Weka classifier can read and write model files outside allowed folders · Zero Radar