CVE-2026-126296 · Package
NO FIX YET · SEE WHAT TO DO
NLTK before 3.10.4 has a path traversal flaw in save_maxent_params() and load_maxent_params() that skips its own pathsec restriction. An attacker who controls the tab_dir argument can read or overwrite model parameter files outside the permitted data directories.
first public Oct 26, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that call NLTK's maxent parameter save or load functions with a tab_dir value that an untrusted user can influence. Code that only uses fixed, trusted paths is unlikely to be exposed. unknown whether other NLTK functions are affected.
Not affected if fixed-paths, no-maxent-params-use
Who cares nltk, python
pip show nltk or python -c "import nltk; print(nltk.__version__)".save_maxent_params or load_maxent_params where the path comes from user input.3.10.4 or later.NLTK before 3.10.4 contains a path traversal vulnerability in save_maxent_params() and load_maxent_params() that bypasses the pathsec filesystem restriction mechanism. Attackers who control the tab_dir argument can read or overwrite model parameter files outside permitted data roots, because the functions call Python's built-in open() directly.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.