Executive brief
NLTK is a widely-used Python natural language processing library that includes sandbox protection (pathsec) to restrict file access to designated data directories. A vulnerability in corpus reader constructors allows attackers to bypass this sandbox and read arbitrary files and SQLite databases from anywhere on the filesystem by supplying a malicious corpus root path. An application using NLTK could expose sensitive configuration files, source code, or other confidential data on the server.
Technical details
The vulnerability is a path traversal / external control of file path (CWE-73) in NLTK's CorpusReader, LinThesaurusCorpusReader, and PanLexLiteCorpusReader constructors. The root cause is that CorpusReader.__init__() converts a user-supplied string root into a FileSystemPathPointer without validating it against the pathsec sandbox, then uses builtin open() and sqlite3.connect() directly on derived paths. This bypasses the pathsec.open() guard that would normally enforce the data-root boundary. An attacker with the ability to control the corpus root path argument to these constructors (a common pattern in applications consuming untrusted corpus specifications) can read any file or database on the system. No special privileges are required; the attack is network-reachable if the vulnerable reader constructors are exposed via a web service or similar. The fix is to validate and route all corpus-root handling through pathsec before file operations. Patched versions are available in NLTK 3.10.3 and later.
Affected products
- NLTK NLTK < 3.10.3
Timeline
- 2026-08-25: disclosed
- 2026-08-11: patched: NLTK 3.10.3 and later contain the fix