DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-12243: CVE-2026-12243: Incomplete Path Traversal Validation and Percent-Encoding Bypass in NLTK

#security #cve #cybersecurity

CVE-2026-12243: Incomplete Path Traversal Validation and Percent-Encoding Bypass in NLTK

Vulnerability ID: CVE-2026-12243
CVSS Score: 7.5
Published: 2026-08-13

CVE-2026-12243 is a path traversal vulnerability in the Natural Language Toolkit (NLTK) version 3.9.4. The flaw exists because the input validation routine fails to account for percent-encoded directory traversal sequences like '..%2f' before passing them to urllib.request.url2pathname(), which decodes them into active traversal sequences.

TL;DR

A path traversal vulnerability in NLTK 3.9.4 allows remote unauthenticated attackers to read arbitrary files via percent-encoded path traversal sequences because lexical validation occurs before URL decoding.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-22
  • Attack Vector: Network (AV:N)
  • CVSS Base Score: 7.5
  • EPSS Score: 0.00583 (Percentile: 44.89%)
  • Impact: Arbitrary File Read / Information Disclosure
  • Exploit Status: Proof-of-Concept (PoC) documented
  • KEV Status: Not listed

Affected Systems

  • Applications employing NLTK for dynamic resource/corpora loading
  • Web-based natural language processing pipelines using NLTK 3.9.4
  • Jupyter notebooks and machine learning environments loading external corpus names
  • NLTK (Natural Language Toolkit): 3.9.4 (Fixed in: 3.9.5)

Mitigation Strategies

  • Upgrade NLTK to version 3.9.5 or higher.
  • Explicitly configure the path security enforcement setting in NLTK to raise errors rather than warning only: nltk.pathsec.ENFORCE = True.
  • Strictly sanitize user-provided file inputs and use alternative lookups like dictionary mapping instead of directly resolving paths from user strings.

Remediation Steps:

  1. Step 1: Install NLTK version 3.9.5 via pip: pip install -U nltk
  2. Step 2: Add import nltk.pathsec and nltk.pathsec.ENFORCE = True at the application entry point to ensure enforcement.
  3. Step 3: If accessing files in the current directory is required, explicitly add the current directory to the search paths using nltk.data.path.append('.') to allow path validation rules to approve it.

References

Read the full report for CVE-2026-12243 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)