CVE-2026-33236
NLTK has a Downloader Path Traversal Vulnerability (AFO) - Arbitrary File Overwrite
HIGH 8.1
En bref
- Source
- NVD
- EPSS
- EPSS 0.60 % · centile 49 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- GitHub_M
- Statut NVD
- Modified
Description
NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. In versions 3.9.3 and prior, the NLTK downloader does not validate the `subdir` and `id` attributes when processing remote XML index files. Attackers can control a remote XML index server to provide malicious values containing path traversal sequences (such as `../`), which can lead to arbitrary directory creation, arbitrary file creation, and arbitrary file overwrite. Commit 89fe2ec2c6bae6e2e7a46dad65cc34231976ed8a patches the issue.
Faiblesses (CWE)
- CWE-22 — Traversée de répertoire
Références
- https://github.com/nltk/nltk/security/advisories/GHSA-469j-vmhf-r6v7
- https://github.com/nltk/nltk/commit/89fe2ec2c6bae6e2e7a46dad65cc34231976ed8a
- https://access.redhat.com/security/cve/CVE-2026-33236
- https://bugzilla.redhat.com/show_bug.cgi?id=2449824
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33236.json
- https://access.redhat.com/errata/RHSA-2026:10184
- https://access.redhat.com/errata/RHSA-2026:42644
- https://access.redhat.com/errata/RHSA-2026:19712
- https://access.redhat.com/errata/RHSA-2026:37275
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H | GitHub_M |
| CVSS 3.1 | HIGH 8.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H | redhat-SADP |
| CVSS 3.1 | HIGH 8.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H | NVD · security-advisories@github.com (Secondary) |
| CVSS 3.1 | HIGH 8.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H | NVD · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c (Secondary) |
Avis
- GHSA-469j-vmhf-r6v7 — NLTK has a Downloader Path Traversal Vulnerability (AFO) - Arbitrary File Overwrite
- PYSEC-2026-2237 — NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Proce
Références européennes
- ENISA EUVD · EUVD-2026-13887
- GCVE · GCVE-0-2026-33236
Avis du CERT-FR
- CERTFR-2026-AVI-1378 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1206 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1094 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0556 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:nltk:nltk:*:*:*:*:*:*:*:*≤ 3.9.3
Produits affectés
| Produit | Versions |
|---|---|
| nltk · nltk | affected <= 3.9.3 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |