NLTK Vulnerable To Path Traversal

高危 7.5CVE-2019-14751 · GHSA-mr7p-25v2-35wr · PYSEC-2019-106 · Published 22/08/2019 · updated 17/06/2026

要点

CVE-2019-14751 是影响 nltk, nltk (nltk) 的高危 (CVSS 7.5)漏洞。
未来 30 天内被利用的概率（EPSS）：5.7%，高于 93.0% 的漏洞。
修复：升级到 3.4.5 或更高版本。

Package	Affected versions	Patched versions
nltk PyPI	`< 3.4.5`	`3.4.5`
nltk nltk	`< 3.4.5`	`3.4.5`

Description

NLTK Downloader before 3.4.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in an NLTK package (ZIP archive) that is mishandled during extraction.

NVD description

NLTK Downloader before 3.4.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in an NLTK package (ZIP archive) that is mishandled during extraction.

References

nvd.nist.gov/vuln/detail/CVE-2019-14751 · ADVISORY
nltk/nltk commit f59d7ed · WEB
GitHub Advisory GHSA-mr7p-25v2-35wr · ADVISORY
mssalvatore/CVE-2019-14751_PoC · WEB
nltk/nltk · PACKAGE
nltk/nltk · WEB
pypa/advisory-database · WEB
lists.fedoraproject.org/archives/list/[email protected]/message/QI4IJGLZQ5S7C5LNRNROHAO2P526XE3D · WEB
lists.fedoraproject.org/archives/list/[email protected]/message/ZGZSSEJH7RHH3RBUEVWWYT75QU67J7SE · WEB
salvatoresecurity.com/zip-slip-in-nltk-cve-2019-14751 · WEB

nltk 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

nltk

PyPI

< 3.4.5

3.4.5

nltk

< 3.4.5

3.4.5

Description

NVD description

nltk 的其他漏洞

查看全部 →