CVE-2019-14751: NLTK Downloader Directory Traversal Vulnerability
Summary
CVE-2019-14751: NLTK Downloader before 3.4.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in an NLTK package (ZIP archive) that is mishandled during extraction. Affects nltk across 2 version ranges.
< 3.4.5
< f59d7ed8df2e0e957f7f247fe218032abdbe9a10
Fixed in f59d7ed8df2e0e957f7f247fe218032abdbe9a10. How to fix ↓
Also tracked for
- nltk · Debian:11
The same CVE-2019-14751 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NLTK (Natural Language Toolkit) is a popular Python library used for natural language processing tasks. It provides various functionalities and resources for tasks such as tokenization, stemming, tagging, parsing, and more. NLTK packages are distributed as ZIP archives. However, prior to version 3.4.5, NLTK Downloader is vulnerable to a directory traversal attack. This vulnerability allows attackers to write arbitrary files by exploiting a mishandling of the '../' (dot dot slash) sequence in an NLTK package during the extraction process.
Vulnerability Detail
The directory traversal vulnerability in NLTK Downloader can be exploited by an attacker to write arbitrary files on the system. By including the '../' sequence in an NLTK package, an attacker can traverse directories and write files outside the intended extraction path. This can lead to unauthorized access, data manipulation, or even remote code execution depending on the context in which the extracted files are used. The vulnerability was fixed in version 3.4.5 of NLTK.
How To Fix
Latest published version: 3.10.4 as of 22 Oct 2026
pip install --upgrade "nltk==3.10.4"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
f59d7ed8df2e0e957f7f247fe218032abdbe9a10
This is the first release that contains the fix.
pip install --upgrade "nltk==f59d7ed8df2e0e957f7f247fe218032abdbe9a10"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The NLTK Downloader directory traversal vulnerability (CVE-2019-14751) allows attackers to write arbitrary files on the system. It is recommended to update NLTK to version 3.4.5 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nltk →
FAQ
NLTK (Natural Language Toolkit) is a Python library used for natural language processing tasks.
A directory traversal vulnerability allows an attacker to access files or directories outside of the intended scope by manipulating file paths.
By exploiting this vulnerability, an attacker can write arbitrary files on the system, potentially leading to unauthorized access, data manipulation, or remote code execution.
Yes, the vulnerability has been fixed in version 3.4.5 of NLTK.
You can update NLTK to the fixed version (3.4.5) by running the command 'pip install --upgrade nltk'.
Related vulnerabilities
Recent vulnerabilities recorded for nltk.
