Executive brief
NLTK is a widely-used Python natural language processing library that includes readers for processing FrameNet and NKJP linguistic corpora. When applications use these readers to load XML data, they expect files to stay within a configured corpus directory for security. This vulnerability allows attackers who can influence corpus selectors or index data to craft special paths that escape the intended root directory and force the library to read arbitrary XML files from elsewhere on the system, potentially exposing sensitive data.
Technical details
The vulnerability is a path traversal (CWE-22) and external control of file paths (CWE-73) that affects FramenetCorpusReader.frame_by_name(), FramenetCorpusReader.doc(), FramenetCorpusReader.lu(), and NKJPCorpusReader.header() methods. Root cause: these readers construct raw XML filenames from unsafe selectors, poisoned index state, or unsafe file identifiers using string concatenation without path normalization or containment checks. Attack vector is network if the reader is exposed via a web API. No authentication is required; callers supply the dangerous selectors directly to public reader methods. Impact: successful exploitation allows reading arbitrary XML files outside the corpus root, potentially exposing sensitive data. The fix was implemented in version 3.10.0 through explicit path-safety rejections that align these readers with the security model used in CorpusReader.open() and nltk.pathsec.
Affected products
- NLTK Project NLTK <= 3.9.4
Timeline
- 2026-08-07: disclosed
- 2026-09-08: advisory
- 2026-09-08: patched: Version 3.10.0 released with fixes