← Vulnerability feed

Vulnerability record · CVE-2019-14751 · published 22 August 2019

CVE-2019-14751: Nltk path traversal vulnerability

Nltk · Nltk

NLTK Downloader before 3.4.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in an NLTK package (ZIP archive) that is mishandled during extraction.

7.5 CVSS 3.0 High EPSS 5.7% · top 7.3% CWE-22 · Path traversal
7.5CVSS 3.0 base score, v2 5.0
5.7%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
16References, 4 tagged exploit
17 Jun 2026Last modified by NVD

Description

NLTK Downloader before 3.4.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in an NLTK package (ZIP archive) that is mishandled during extraction.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00054.html
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00001.html
https://github.com/mssalvatore/CVE-2019-14751_PoC ExploitPatchThird Party Advisory
https://github.com/nltk/nltk/blob/3.4.5/ChangeLog Release Notes
https://github.com/nltk/nltk/commit/f59d7ed8df2e0e957f7f247fe218032abdbe9a10 Patch
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QI4IJGLZQ5S7C5LNRNROHAO
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZGZSSEJH7RHH3RBUEVWWYT7
https://salvatoresecurity.com/zip-slip-in-nltk-cve-2019-14751/ ExploitPatchThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00054.html
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00001.html
https://github.com/mssalvatore/CVE-2019-14751_PoC ExploitPatchThird Party Advisory
https://github.com/nltk/nltk/blob/3.4.5/ChangeLog Release Notes
https://github.com/nltk/nltk/commit/f59d7ed8df2e0e957f7f247fe218032abdbe9a10 Patch
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QI4IJGLZQ5S7C5LNRNROHAO
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZGZSSEJH7RHH3RBUEVWWYT7
https://salvatoresecurity.com/zip-slip-in-nltk-cve-2019-14751/ ExploitPatchThird Party Advisory

Track CVE-2019-14751 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2026-0848Nltk improper input validation vulnerabilityNLTK versions <=3.9.2 are vulnerable to arbitrary code execution due to improper input validation in the StanfordSegmenter module. The module dynamic…EPSS 0.81%9.4CVE-2026-78683Nltk deserialization of untrusted data vulnerabilityNLTK before 3.10.0 (affected versions <=3.9.4) contains an unsafe pickle deserialization vulnerability in the TransitionParser.parse() method (nltk/p…EPSS 0.51%9.3CVE-2026-79675Nltk argument injection vulnerabilityNLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java() function, allowing attackers to inject d…EPSS 0.78%9.3CVE-2026-79657Nltk deserialization of untrusted data vulnerabilityNLTK versions before 3.10.3 contain a remote code execution vulnerability in allowlisted pickle loaders that trust entire module namespaces instead o…EPSS 1.3%8.8CVE-2026-79674Nltk vulnerabilityNLTK versions before 3.10.3 contain a path sandbox bypass vulnerability in corpus-reader constructors that allows attackers to read files outside the…EPSS 0.39%8.8CVE-2025-14009Nltk code injection vulnerabilityA critical vulnerability exists in the NLTK downloader component of nltk/nltk, affecting all versions. The _unzip_iter function in nltk/downloader.py…EPSS 0.95%8.7CVE-2026-81722Nltk vulnerabilitynltk PorterStemmer in versions <= 3.10.2 (fixed in 3.10.3) contains an inefficient-algorithmic-complexity denial of service in PorterStemmer.stem(). …EPSS 0.52%8.7CVE-2026-80205Nltk inefficient regular expression (redos) vulnerabilityNLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.findall() and TokenSearcher.findall() methods that a…EPSS 0.65%

Source: NIST National Vulnerability Database (record CVE-2019-14751), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.