CVE-2026-12243: Path Traversal via Percent-Encoding in nltk.data.find() and nltk.data.load()
NLTK version 3.9.4 is vulnerable to a path traversal attack due to an incomplete fix for GitHub Issue #3504. The UNSAFENOPROTOCOLRE regex in nltk/data.py checks for literal ../ sequences but fails to account for percent-encoded traversal sequences such as ..%2f. The url2pathname() function decodes these sequences after the validation step, allowing an attacker to bypass the protection. This vulnerability enables an attacker to read arbitrary files accessible to the Python process by controlling the resource name parameter passed to nltk.data.load() or nltk.data.find(). The issue affects applications that rely on NLTK for resource loading, including NLP web applications, Jupyter notebooks, and CLI tools. The default pathsec.ENFORCE=False setting exacerbates the impact by not blocking the file read at the open() stage.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nltkto a version that resolves this vulnerability.Fixed in 3.9.4Patch GitHub Issue #3504 - Configuration
Set pathsec.ENFORCE to True to enforce blocking file reads at the open() stage (default is ENFORCE=False, which exacerbates the impact).
nltk.pathsec ENFORCE = True - Compensating control
As a compensating control, avoid accepting untrusted input for the resource name parameter passed to nltk.data.load() or nltk.data.find(); ensure only trusted, expected resource names/paths are used to prevent percent-encoded path traversal from bypassing validation.
Event History
Frequently Asked Questions
What is CVE-2026-12243?
CVE-2026-12243 is a high severity vulnerability in NLTK version 3.9.4 that allows for path traversal attacks via percent-encoded sequences.
How does the path traversal vulnerability work in CVE-2026-12243?
The vulnerability allows attackers to exploit the incomplete fix of percent-encoded traversal sequences, such as `..%2f`, which can bypass security checks.
What are the potential impacts of CVE-2026-12243?
Exploitation of CVE-2026-12243 can lead to unauthorized access to files outside of the intended directory structure.
How can I fix CVE-2026-12243?
To fix CVE-2026-12243, update to the latest version of NLTK that addresses the path traversal vulnerability.
What should I do if I am using NLTK version 3.9.4?
If you are using NLTK version 3.9.4, it is critical to upgrade to a patched version to mitigate the risk of path traversal attacks.