Listen to this Post
NLTK versions before 3.10.0 contain a path traversal vulnerability in `FramenetCorpusReader` and `NKJPCorpusReader` that allows attackers to parse XML files outside the corpus root by supplying unsafe selectors or poisoned index state. Attackers can exploit frame_by_name, doc, lu, and `header` methods with crafted parameters to read arbitrary XML files accessible to the application.
The root cause is that several stable reader paths still construct raw XML filenames from unsafe selectors, poisoned index state, or unsafe file identifiers without preserving the corpus-root boundary. Specifically, four public stable entrypoints return parsed outside-root content: a parent-segment traversal frame name, a poisoned fulltext index filename, a poisoned LU id, and an unsafe NKJP header file identifier. The current source (v3.10.0-rc2) rejects the same payloads with explicit path-safety errors, confirming the bug is real but version-scoped to the published stable package (3.9.4).
The vulnerability is classified as CWE-73: External Control of File Name or Path. The affected components are:
– `FramenetCorpusReader.frame_by_name`
– `FramenetCorpusReader.doc`
– `FramenetCorpusReader.lu`
– `NKJPCorpusReader.header`
The fix is included in version 3.10.0, which includes the path-safety rejections seen in the release candidate.
DailyCVE Form:
Platform: NLTK
Version: <3.10.0
Vulnerability: Path Traversal
Severity: Medium (CVSS 5.9)
Date: 2026-08-22
Prediction: Patch available in 3.10.0
What Undercode Say:
Check installed NLTK version python -c "import nltk; print(nltk.<strong>version</strong>)" Upgrade to patched version pip install --upgrade nltk>=3.10.0 Verify patch python -c "import nltk; print(nltk.<strong>version</strong>)"
Exploit: (Educational Purposes!)
from nltk.corpus import framenet as fn Unsafe frame name with path traversal malicious_frame = "../../etc/passwd" frame_by_name() reads XML outside corpus root result = fn.frame_by_name(malicious_frame) Unsafe LU id with traversal malicious_lu = "../../sensitive/file" lu().exemplars reads outside root result = fn.lu(malicious_lu).exemplars Unsafe document filename malicious_doc = "../../secret/data" doc() reads outside root result = fn.doc(malicious_doc)
Protection:
- Upgrade NLTK to version 3.10.0 or later
- Validate all user-supplied frame names, LU IDs, and file identifiers before passing to reader methods
- Use `nltk.pathsec` module for path confinement instead of raw `open()` calls
- Restrict corpus root to a dedicated directory with no access to sensitive files
Impact:
Applications that process attacker-influenced FrameNet or NKJP corpus selectors or state can be made to parse XML outside the trusted corpus root through normal public reader responses. This may lead to unauthorized disclosure of sensitive files accessible to the application process, including configuration files, credentials, or other confidential data.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
