Path Traversal Vulnerability in NLTK Affects Python Applications and Services

CVE-2026-12243

What is CVE-2026-12243?

NLTK version 3.9.4 is susceptible to path traversal due to an incomplete fix for a previous issue. The vulnerability arises from the _UNSAFE_NO_PROTOCOL_RE regex, which only checks for literal '../' sequences but ignores percent-encoded traversal sequences like '..%2f'. As a result, the url2pathname() function allows for decoding these sequences after validation, enabling attackers to manipulate the resource name parameter in nltk.data.load() or nltk.data.find(). This flaw permits unauthorized access to files that the Python process can read, affecting various applications dependent on NLTK for resource management, including NLP web applications, Jupyter notebooks, and command-line interface tools. The impact is further exacerbated when the pathsec.ENFORCE=False setting does not block file reads during the opening phase.

References