8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-33236

CVE-2026-33236: NLTK has a Downloader Path Traversal Vulnerability (AFO) - Arbitrary File Overwrite

NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. In versions 3.9.3 and prior, the NLTK downloader does not validate the subdir and id attributes when processing remote XML index files. Attackers can control a remote XML index server to provide malicious values containing path traversal sequences (such as ../), which can lead to arbitrary directory creation, arbitrary file creation, and arbitrary file overwrite. Commit 89fe2ec2c6bae6e2e7a46dad65cc34231976ed8a patches the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-33236

CVE-2026-33236:

8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
nltk	pip	<= 3.9.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the NLTK downloader component, specifically in how it handles package metadata from remote XML index files. The root cause is a lack of input validation on the id and subdir attributes of a package defined in the XML index. An attacker can host a malicious XML file with path traversal sequences (e.g., ../) in these attributes.

When a user attempts to download a package using nltk.downloader.Downloader.download(), the following occurs:

The Package.fromxml method is called to parse the malicious XML, which in turn calls the Package.__init__ constructor.
Inside Package.__init__, the unvalidated subdir and id attributes are used with os.path.join to create a filename attribute on the Package object. This filename now contains a path that traverses outside the intended download directory.
The Downloader.download method eventually calls Downloader._download_package.
In _download_package, the malicious info.subdir is used with os.makedirs to create directories at an arbitrary location. Subsequently, the malicious info.filename is joined with the base download directory to create a final filepath. This filepath is then used with open() to write a file, resulting in an arbitrary file write vulnerability.

The identified functions are the key components in this attack chain, from the initial parsing of malicious data to the final vulnerable file system operations.

Vulnerable functions

Package.fromxml

nltk/downloader.py

This static method creates a `Package` object from a parsed XML element. It passes the attributes from the XML, including the malicious `subdir` and `id`, to the `Package` constructor without prior validation. This is the initial entry point for the tainted data.

Package.__init__

nltk/downloader.py

The constructor for the `Package` class is vulnerable because it directly uses the `subdir` and `id` attributes from a remote XML index to construct a `filename`. It uses `os.path.join` to combine these attributes, which allows path traversal sequences (like `../`) in the `subdir` and `id` to create a malicious file path that points outside the intended download directory.

Downloader._download_package

nltk/downloader.py

This method is responsible for the actual download and file writing. It constructs the final file path by joining the `download_dir` with the malicious `info.filename` (which contains the traversal path). It then proceeds to create directories using the malicious `info.subdir` via `os.makedirs` and writes a file to the traversed path using `open()`, leading to arbitrary directory and file creation/overwrite.

Downloader.download

nltk/downloader.py

This is the main public method that users call to download a package. It orchestrates the download process, which involves fetching the package information and calling the vulnerable `_download_package` method. An exploit would involve calling this function with the ID of a package defined in a malicious remote index.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.