CVE-2026-12243 NLTK Path Traversal Vulnerability: Percent-Encoding Bypass Allows Arbitrary File Read

Technical summary

NLTK's `nltk/data.py` implements a regex check (`_UNSAFE_NO_PROTOCOL_RE`) designed to block path traversal attempts in the `nltk.data.load()` and `nltk.data.find()` functions. The regex detects literal `../` sequences, but the validation occurs before URL decoding. An attacker can submit percent-encoded traversal sequences (e.g., `..%2f`) that bypass the regex, then pass decoding in the `url2pathname()` function, where the traversal intent becomes apparent. The vulnerability is exacerbated by NLTK's default `pathsec.ENFORCE=False` setting, which means no additional file-access restrictions are enforced at the `open()` call stage. This is a bypass of a previous incomplete fix for GitHub Issue #3504.

Business impact

Affected organizations face unauthorized disclosure of sensitive data. Applications using NLTK—including NLP web services, Jupyter-based data science platforms, and command-line tools—can expose configuration files, API keys, database credentials, source code, or other files readable by the application process. The impact depends on what files the Python process has permission to access, but in typical deployments, this could include the entire application codebase and configuration directory.

Affected systems

NLTK version 3.9.4 is confirmed vulnerable. Organizations running NLP applications, chatbot platforms, text analysis tools, and data science environments that depend on NLTK for resource loading should audit their deployments. The vulnerability affects any code path that calls `nltk.data.load()` or `nltk.data.find()` with untrusted or user-supplied resource names.

Exploitability

Exploitation requires no authentication, no user interaction, and no special network configuration—a remote attacker can craft a malicious resource name and submit it to an exposed API endpoint or web interface. The attack is trivial to execute: an attacker simply needs to provide a percent-encoded path traversal string such as `..%2f..%2fetc%2fpasswd` as the resource parameter. The low complexity and lack of prerequisites make this vulnerability highly practical to exploit in the wild.

Remediation

Upgrade NLTK to a patched version that correctly validates resource names before and after URL decoding. Additionally, configure `pathsec.ENFORCE=True` to enable strict file-access restrictions as a defense-in-depth measure. Organizations should audit their code to identify all calls to `nltk.data.load()` and `nltk.data.find()` and ensure resource names are not derived from untrusted input; if they must be, implement strict allowlisting of permitted resource names.

Patch guidance

Check the official NLTK GitHub repository and PyPI for a patched release addressing CVE-2026-12243. Verify against the vendor advisory before patching. Once a patch is released, update via your standard package management process (e.g., `pip install --upgrade nltk`). Test the update in a development environment first, particularly if your application relies on custom NLTK data paths or custom resource loading logic. Document the patched version in your dependency manifest.

Detection guidance

Monitor application logs for suspicious calls to `nltk.data.load()` or `nltk.data.find()` containing percent-encoded characters (e.g., `%2f`, `%2e`), particularly in patterns that resemble `..%2f`. Look for access attempts to files outside the expected NLTK data directory. Network-based detection can flag HTTP requests containing percent-encoded traversal sequences in parameters passed to endpoints that invoke NLTK resource loading. File integrity monitoring may alert if unexpected files are accessed by the Python process.

Why prioritize this

This vulnerability merits immediate attention despite not being on the CISA KEV list. It scores 7.5 (HIGH) with a network-exploitable vector, no authentication required, and straightforward bypass mechanics. The vulnerability affects a widely-used NLP library in web applications and data platforms where user input often flows to resource loading functions. The incomplete nature of the prior fix suggests a pattern of underestimating encoding bypass techniques, raising confidence in real-world exploitation.

Risk score, explained

CVSS 3.0 score of 7.5 reflects: (1) Network-accessible attack vector with no authentication or user interaction required; (2) Low attack complexity—simple percent-encoding bypass; (3) High confidentiality impact—arbitrary file read; (4) No integrity or availability impact; (5) Unchanged scope. The score appropriately reflects the severity for information disclosure but acknowledges no system compromise or DoS risk.

Frequently asked questions