Path traversal in Natural Language Toolkit - #VU159477
Published: November 5, 2026
Vulnerability details
The vulnerability allows an attacker controlling a WekaClassifier model path in Natural Language Toolkit (NLTK) to bypass NLTK data-root containment and create or overwrite files outside the allowed roots, or cause Weka to read and attempt to parse files outside those roots. Writes contain Weka serialized-model data but can corrupt attacker-selected files. Reads expose an existence or parsing differential rather than returning file contents, limiting the confidentiality impact.
The vulnerability exists due to missing model-path validation in nltk/classify/weka.py. WekaClassifier.train passes the caller's model_filename verbatim as the Java program's -d argument, causing Weka to write the trained model at that location. The constructor stores the model path without validation, and WekaClassifier._classify_many passes it as the -l argument, causing Weka to load it. A remote attacker can supply an absolute or parent-directory traversal path through an application that lets an untrusted workflow choose the model save or load path, directing these operations outside the allowed NLTK data roots even when nltk.pathsec.ENFORCE is true.
Only internally generated training and test ARFF files are staged; the model path is not checked by validate_tool_path or validate_model_resource. The Java wrapper validates the classpath, JVM launcher options, and main-class token and rejects argument-file tokens, but does not validate path values supplied as program arguments. Consequently, these paths reach the Weka JVM through subprocess.Popen with shell execution disabled; exploitation does not require shell injection. A configured Weka JAR is required for the actual file operations, which run with the application's filesystem permissions.