CVE-2019-14751: nltk Path Traversal
CVSS: 7.5v3.0HighModified
AliasesMGASA-2020-0160openSUSE-SU-2020:0440-1GHSA-mr7p-25v2-35wrPYSEC-2019-106UBUNTU-CVE-2019-14751USN-4106-1DEBIAN-CVE-2019-14751openSUSE-SU-2020:0436-1openSUSE-SU-2024:11241-1
Published 22-08-2019Last modified 05-08-2024
Vulnerability summary
CVE-2019-14751 is a high (CVSS 7.5) Path Traversal vulnerability in nltk. EPSS estimates a 5.67% chance of exploitation in the next 30 days, higher than 92.9% of scored vulnerabilities. 2 public exploits are recorded.
CVSS score
7.5/10
010
High · v3.0 (NVD)EPSS score
5.67%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits2github, reference
Advisory lineage
Upstream 0 · Downstream 3 · Related 3Timeline
- 22-08-2019PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
NLTK Downloader before 3.4.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in an NLTK package (ZIP archive) that is mishandled during extraction.
CVSS metrics
6 scores · 4 sources · 3 versionsHigh 8.7Preferred score · OSV · Pypi (Ecosystem advisory) · calculated from vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:NSourcesSingle source
High 7.5Preferred score · NVD (NIST)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NSourcesAll 4 agree
- OSV · PypiEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Medium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:N/I:P/A:NSourcesSingle source
EPSS trend
Probability
5.67%
Chance of exploitation in the next 30 days
Percentile
93%
Versus all other CVEs
30-day change
0.00 pp
From 5.67% on 19-09-2026
19-09-202619-10-2026
EPSS score5.67%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundCve 2019 14751 Poc
Maturity: poc
Exploit Reference (salvatoresecurity.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Opensuse2 products
- python-nltk&distro=openSUSE Leap 15.1< 3.4.5-lp151.4.3.1
- python-nltk&distro=openSUSE Tumbleweed< 3.5-1.10
Debian1 product
- nltk< 3.4.5-1
Mageia1 product
- python-nltk< 3.4.5-1.1.mga7
Nltk1 product
- nltk< 3.4.5
PyPI1 product
- nltk< f59d7ed8df2e0e957f7f247fe218032abdbe9a10 | < 3.4.5
Suse1 product
- python-nltk&distro=SUSE Package Hub 15 SP1< 3.4.5-bp151.4.3.1
Ubuntu1 product
- nltk< 2.0~b9-0ubuntu4.1~esm2 | < 3.1-1ubuntu0.1 | < 3.2.5-1ubuntu0.1
7 vendors · 8 products
References
28 links- salvatoresecurity.com/zip-slip-in-nltk-cve-2019-14751/X Refsource MISCExploitPatchThird Party AdvisoryWEBREPORT
- lists.opensuse.org/opensuse-security-announce/2020-03/msg00054.htmlVendor AdvisoryX Refsource SUSEWEB
- lists.opensuse.org/opensuse-security-announce/2020-04/msg00001.htmlVendor AdvisoryX Refsource SUSEWEB
Show all 28 references
- lists.opensuse.org/archives/…Advisory
- github.com/nltk/nltkPACKAGE
- lists.opensuse.org/archives/…Advisory