Advisoriesby IbisNLTK: path traversal
Summary
WekaClassifier in NLTK passes a caller-controlled model file path to the weka Java VM without any nltk.pathsec validation. WekaClassifier.train puts the caller's model_filename verbatim into the weka argv ["-d", model_filename, ...] (weka *writes* the trained model there), and WekaClassifier._classify_many puts self._model into ["-l", self._model, ...] (weka *reads* it). Under nltk.pathsec.ENFORCE=True (the default on current HEAD), NLTK's stated invariant , established by advisory CVE-2026-81726 / GHSA-8mgp-746c-j5xp , is that caller-controlled model-artifact paths must be bounded to the allowed NLTK data roots before any native tool opens them. WekaClassifier is the one java()-based tool wrapper that skips this entirely, giving an untrusted workflow arbitrary-location file write (-d) and an arbitrary file read/parse oracle (-l), defeating pathsec containment.
This is a standalone, unfixed variant of the same class as CVE-2026-81726, on a code path the CVE-2026-81726 fix never touched. That advisory enumerates 6 functions (TransitionParser.train, TransitionParser.parse, AveragedPerceptron.save, AveragedPerceptron.load, PerceptronTagger.save_to_json, save_maxent_params) , WekaClassifier is not among them, and weka.py contains no validate_tool_path/validate_model_resource at all.
Root Cause...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| nltk PyPI | < 3.10.4 | 3.10.4 |
Details and references
## Summary `WekaClassifier` in NLTK passes a caller-controlled model file path to the weka Java VM without any `nltk.pathsec` validation. `WekaClassifier.train` puts the caller's `model_filename` verbatim into the weka argv `["-d", model_filename, ...]` (weka *writes* the trained model there), and `WekaClassifier._classify_many` puts `self._model` into `["-l", self._model, ...]` (weka *reads* it). Under `nltk.pathsec.ENFORCE=True` (the default on current HEAD), NLTK's stated invariant , established by advisory CVE-2026-81726 / GHSA-8mgp-746c-j5xp , is that caller-controlled model-artifact paths must be bounded to the allowed NLTK data roots before any native tool opens them. `WekaClassifier` is the one `java()`-based tool wrapper that skips this entirely, giving an untrusted workflow arbitrary-location file **write** (`-d`) and an arbitrary file **read/parse oracle** (`-l`), defeating pathsec containment. This is a standalone, unfixed variant of the same class as CVE-2026-81726, on a code path the CVE-2026-81726 fix never touched. That advisory enumerates 6 functions (`TransitionParser.train`, `TransitionParser.parse`, `AveragedPerceptron.save`, `AveragedPerceptron.load`, `PerceptronTagger.save_to_json`, `save_maxent_params`) , `WekaClassifier` is not among them, and weka.py contains no `validate_tool_path`/`validate_model_resource` at all. ## Root Cause `WekaClassifier.train(cls, model_filename, ...)` builds `cmd = [javaclass, "-d", model_filename, "-t", train_filename]` (nltk/classify/weka.py:256) and `WekaClassifier._classify_many` builds `[..., "-l", self._model, "-T", <staged>, ...]` (weka.py:131-133); `self._model` is stored unvalidated in `__init__` (weka.py:108-110). Only the internally-generated `train.arff`/`test.arff` are staged via `make_staging_dir`; the model path is passed as-is. `nltk.internals.java()` (internals.py:388-431) validates the classpath (`_verify_jar_sandbox`), the JVM launcher options (`_validate_java_options`, the CVE-2026-12841 fix), the main-class token `cmd[0]`, and rejects `@argfile` tokens in any position , but it explicitly permits program arguments starting with `-` and never inspects the interior of a program-arg path value. So `-d <path>` / `-l <path>` flow unchecked to `subprocess.Popen(final_cmd, shell=False)` and the weka JVM performs an unbounded native open/write on the caller-chosen path. Sibling wrappers prove the intended pattern: `CRFTagger.train`/`set_model_file` call `validate_tool_path` (crf.py:134,300); `MaltParser.generate_malt_command` validates `-i`/`-o` via `validate_tool_path` (malt.py:340,344), its model via `validate_model_resource` (malt.py:326) and `working_dir` via `validate_path` (malt.py:206). weka.py already uses pathsec elsewhere (`validate_path` for WEKAHOME, `pathsec_open` for ARFF writes) but never for the model path. ## Impact Under `pathsec.ENFORCE=True` (default on HEAD), an untrusted workflow that chooses the weka model save/load path obtains: - Arbitrary-location file **write** via `-d` , overwrite or create a file at an attacker-chosen absolute or `..`-traversal path outside the allowed NLTK data roots (content constrained to weka's serialized-model format; the target choice is the integrity impact). This corrupts/clobbers arbitrary chosen files. - Arbitrary file **read/parse oracle** via `-l` , weka loads an out-of-root path as a model, yielding an existence/parse differential (file content is not echoed back → confidentiality impact is limited). This defeats the pathsec containment advisory CVE-2026-81726 promises, at the same privilege level / threat model that advisory was accepted under. ## Proof of Concept ```python import nltk.pathsec as ps; ps.ENFORCE = True from nltk.classify.weka import WekaClassifier # write-side: model written OUTSIDE any allowed NLTK data root (refused for CRFTagger, allowed here) WekaClassifier.train("/tmp/outside_sandbox/evil.model", [({"a": 1}, "pos"), ({"a": 0}, "neg")]) # read-side: -l
More NLTK advisories
All NLTK
NLTK: Pl196xCorpusReader has quadratic ReDoS on malformed TEI blocksCVE-2026-81725fixed in 3.10.3NLTK: ReDoS in nltk.tgrep via unvalidated user-supplied regular expressionsCVE-2026-80206fixed in 3.10.3NLTK: ReDoS in nltk.text.Text.findall() via unvalidated user-supplied regular expressionsCVE-2026-80205fixed in 3.10.0NLTK: Corpus Reader Sandbox BypassCVE-2026-79674fixed in 3.10.3NLTK: Corpus readers follow symlinks outside trusted roots despite pathsec enforcementCVE-2026-79676fixed in 3.10.3NLTK: Allowlisted pickle loaders still permit code execution in current sourceCVE-2026-79657fixed in 3.10.3