Path Traversal Vulnerability in NLTK by Natural Language Toolkit

CVE-2026-54293

What is CVE-2026-54293?

The NLTK (Natural Language Toolkit) vulnerability allows attackers to exploit a flaw in the file handling mechanism, particularly through the nltk.data.load() function. This security issue stems from improper validation of URL-encoded path separators, enabling path traversal attacks. Although direct traversal sequences are effectively blocked, encoded variants evade the regex checks, facilitating unauthorized access to sensitive filesystem locations. This threat can lead to leakage of critical data, compromising the security of applications utilizing NLTK. The vulnerability has been addressed in version 3.10.0-rc1.

References