PT-2026-49738 · Pypi · Nltk
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
NLTK versions prior to 3.10.0-rc1
Description
The
nltk.data.load() function is subject to path traversal when using the nltk: URL scheme. The issue arises because the UNSAFE NO PROTOCOL RE regex check is performed on the raw resource string before the url2pathname() function decodes percent-encoded sequences. This decode-after-check flaw allows attackers to bypass security protections by using URL-encoded path separators (e.g., %2f for /) and traversal segments (e.g., %2e%2e%2f for ../), enabling the reading of arbitrary files from the filesystem. Technical details indicate the flaw involves the find(), normalize resource url(), and UNSAFE NO PROTOCOL RE components within nltk/data.py.Recommendations
Update to version 3.10.0-rc1 or later.
As a temporary workaround, restrict untrusted input from reaching the
nltk.data.load() function.Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Nltk