Executive brief
NLTK is a widely-used Python library for natural language processing that provides functions to load data resources from disk. A path traversal vulnerability in the data loading mechanism allows attackers to read arbitrary files on the system by supplying specially crafted percent-encoded pathnames that bypass security checks. This could expose sensitive data such as credentials, SSH keys, and configuration files to anyone who can control the input passed to these functions.
Technical details
The vulnerability exists in nltk/data.py's find() and load() functions, which resolve user-supplied resource names to filesystem paths using url2pathname(). The root cause is that path safety checks are performed on the raw, still-encoded resource name string before url2pathname() is called. An attacker can supply percent-encoded path traversal sequences (e.g., %2e%2e instead of .., or .%2e, %2e., %2E%2E) that pass the validation checks but decode to ".." after the safety verification occurs. No privileges or user interaction are required; the attack is triggered by passing a malicious resource name string to nltk.data.load() or nltk.data.find(). The fix involves decoding the resource name using urllib.parse.unquote() before performing path safety checks. Patched in version 3.10.0.
Affected products
- NLTK Project nltk < 3.10.0
Timeline
- 2026-08-07: disclosed
- 2026-08-13: advisory
- 2026-08-13: patched: Version 3.10.0 released with fix