Executive brief
A vulnerability in the Natural Language Toolkit (NLTK) library, a popular tool for processing human language data, allows attackers to read sensitive files from the underlying server. By providing specially crafted file paths, an attacker can bypass security restrictions intended to keep the software within its designated data folders. This could lead to the exposure of private configuration files, API keys, or other sensitive system data.
Technical details
A path traversal vulnerability (CWE-22) exists in the `NKJPCorpusReader` class of NLTK due to improper path validation. The `add_root()` method uses plain string concatenation for file paths without normalization, and the reader subsequently uses the Python built-in `open()` function instead of NLTK's hardened `FileSystemPathPointer.open()`. This implementation bypasses the `nltk.pathsec` sandbox, even when `ENFORCE=True` is configured. An attacker who can influence the `fileids` argument in methods such as `header()`, `raw()`, or `words()` can use '..' sequences to escape the corpus root and read arbitrary files on the host filesystem. The issue is patched in version 3.10.0.
Affected products
- Natural Language Toolkit (NLTK) Project nltk <= 3.9.4
Timeline
- 2026-06-11: disclosed
- 2026-06-15: kev added: Published to NVD
- 2026-07-31: advisory: GitHub Advisory published
- 2026-07-31: patched: Version 3.10.0 released