CVE-2026-54293: NLTK Path Traversal via Encoded URL Separators (CVSS 7.5)

Technical summary

CVE-2026-54293 is a classic decode-after-check or TOCTOU-style vulnerability in NLTK's nltk.data.load() function. The vulnerability arises because path validation via regex occurs on the encoded URL before url2pathname() decodes %xx hex sequences. An attacker can use percent-encoded representations of directory traversal components—such as %2f for '/', %2e for '.', or combinations like %2e%2e%2f for '../'—to construct payloads that pass the initial validation but resolve to traversal paths after decoding. The security checks documented in NLTK's SECURITY.md file, which block literal traversal strings (e.g., ../../../etc/passwd), do not account for their encoded variants. This allows arbitrary file reads on systems where NLTK processes untrusted URLs using the nltk: scheme.

Business impact

Organizations using NLTK in applications that process untrusted input or expose the nltk: URL loading mechanism to users face confidential information disclosure risk. An attacker with network access to a vulnerable application could exfiltrate sensitive files—configuration files, API keys, private certificates, or other data stored on the server—without authentication. In environments where NLTK-based NLP services process user-supplied data or URLs, this creates a direct path to privilege escalation or lateral movement if high-value credentials are accessible. The risk is highest for data science platforms, automated content analysis systems, and any service that loads NLTK resources dynamically based on user input.

Affected systems

NLTK versions prior to 3.10.0-rc1 are affected. This includes all stable releases up to and including 3.9.x. Any Python application embedding NLTK and using nltk.data.load() with untrusted URL inputs is at risk. The vulnerability does not require the attacker to have local access; remote exploitation is possible if the application exposes the loading mechanism to external input. Systems running NLTK in isolated or sandboxed environments with strict file system permissions may have reduced exposure, but defense-in-depth approaches should not rely solely on file permissions to mitigate this flaw.

Exploitability

This vulnerability is readily exploitable with minimal complexity. No authentication, user interaction, or special privileges are required; an attacker simply needs network-level access to the vulnerable application. The attack requires only crafting a malicious URL with percent-encoded traversal sequences—a task well within the capability of a novice attacker. Proof-of-concept generation is straightforward, making widespread exploitation likely once details are public. The CVSS score of 7.5 (High severity) reflects the high attack vector (network), low attack complexity, and the confidentiality impact of arbitrary file reads.

Remediation

Upgrade NLTK to version 3.10.0-rc1 or later, which fixes the decode-after-check flaw by performing path validation after URL decoding. For organizations unable to upgrade immediately, implement network-level controls to restrict which URLs and URL schemes applications are permitted to load, or disable the nltk: URL scheme entirely if not required for your workflow. Code review should identify all instances of nltk.data.load() and assess whether they process untrusted input; if so, prioritize patching or isolate affected services.

Patch guidance

Verify your current NLTK version with `pip show nltk` or `import nltk; print(nltk.__version__)`. Upgrade using `pip install --upgrade nltk` to pull the latest patched release. Test the upgrade in a staging environment to ensure compatibility with dependent packages and your application's NLP workflows. Pin the dependency to 3.10.0-rc1 or later in your requirements.txt or equivalent dependency manifest. Note that release candidates (3.10.0-rc1) may be flagged as pre-release; ensure your package manager is configured to accept release candidates or wait for the stable 3.10.0 release once available.

Detection guidance

Monitor application logs for unusual nltk.data.load() calls or URL patterns containing percent-encoded characters (%2f, %2e, %25) in nltk: URLs. Network intrusion detection systems should flag requests with encoded traversal sequences targeting NLP-processing services. File access logs on systems running NLTK should be reviewed for unexpected reads of sensitive files (e.g., /etc/passwd, configuration directories, SSH keys) correlated with NLP service activity. Conduct code review for all calls to nltk.data.load() and assess risk based on whether inputs are user-controlled or untrusted.

Why prioritize this

This vulnerability merits immediate attention due to its high CVSS score (7.5), network-accessible attack vector, and lack of authentication requirements. The fix is straightforward (upgrade to 3.10.0-rc1), and NLTK's broad use in data science and AI/ML workflows means exposure is likely in many organizations. The potential for confidential data exfiltration and the simplicity of exploitation create strong urgency. Organizations should prioritize patching systems running NLTK in production or staging environments, especially those processing external data or exposing NLP services.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects: Attack Vector (Network) = high accessibility; Attack Complexity (Low) = no special setup required; Privileges Required (None) = no authentication; User Interaction (None) = purely attacker-driven; Confidentiality Impact (High) = arbitrary file reads; Integrity and Availability (None) = no data modification or denial of service. This is a straightforward information disclosure flaw with broad exploit potential.

Frequently asked questions