Description

NLTK 3.9.4 through 3.10.2 contains a path traversal vulnerability in CrubadanCorpusReader. _load_lang_ngrams joins the corpus root with crubadan_code, the column-0 value read from the corpus table.txt mapping file, and opens the result with the builtin open() rather than the pathsec-validated opener, so os.path.join discards the root when that value is absolute and the read escapes the corpus directory without the containment check nltk.pathsec applies when ENFORCE is set. An attacker who controls a corpus package can disclose file contents outside the corpus root through lang_freq, limited to paths ending in -3grams.txt whose contents parse as token count lines.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.5",
  "pubDate": "2026-08-22T14:16:33.560Z",
  "pubdate": "2026-08-22T14:16:33.560Z",
  "executiveSummary": "NLTK versions 3.9.4 through 3.10.2 contain a critical path traversal vulnerability residing within the CrubadanCorpusReader component. The flaw arises because the application improperly handles file paths by utilizing the built-in open() function rather than the secure, pathsec-validated opener when loading language n-grams. Specifically, the _load_lang_ngrams function concatenates the corpus root with the untrusted crubadan_code value—derived from the column-0 entry of the corpus table.txt mapping file. Because os.path.join discards the corpus root if the untrusted input is an absolute path, an attacker can bypass directory containment checks even when ENFORCE is set.\nThe primary impact of this vulnerability is unauthorized file content disclosure outside the intended corpus directory via the lang_freq mechanism. Exploitation is constrained to reading files whose paths terminate with -3grams.txt and whose contents can successfully parse as token count lines. To execute this attack, an adversary must possess the capability to control or supply a malicious corpus package containing a manipulated table.txt mapping file. Consequently, risk implications center on the potential exposure of sensitive system files accessible to the execution context of the Python process running NLTK, necessitating immediate defensive measures to secure corpus ingestion and file-loading logic.",
  "technicalDetails": "The root cause of this vulnerability is an improper input validation and path resolution flaw within the CrubadanCorpusReader component of NLTK. Specifically, the vulnerable method _load_lang_ngrams is responsible for reading language frequency n-grams from corpus files. The implementation constructs target file paths by passing parameters to os.path.join, combining the designated corpus root directory with the crubadan_code value. This crubadan_code value is directly read from column-0 of the table.txt mapping file contained within the corpus package.\nThe core cryptographic and structural vulnerability stems from the behavior of Python's os.path.join function. When the crubadan_code value supplied by the attacker is formatted as an absolute path, os.path.join discards all preceding path segments—including the secure corpus root—and evaluates the absolute path directly. Furthermore, the vulnerable code path utilizes the standard built-in open() function instead of the pathsec-validated opener. As a result, the containment verification checks typically enforced by nltk.pathsec when the ENFORCE flag is active are completely bypassed.\nThe attack flow proceeds as follows: First, an attacker crafts or modifies a corpus package to include a malicious table.txt mapping file. Within this mapping file, the column-0 value (crubadan_code) is set to an absolute path traversing outside the intended corpus directory structure, while ensuring the target path terminates with the required -3grams.txt suffix. Second, the victim or an automated process instantiates the CrubadanCorpusReader and invokes operations that trigger _load_lang_ngrams. Third, os.path.join resolves the attacker-supplied absolute path, ignoring the corpus root. Fourth, the built-in open() function reads the targeted file outside the sandbox.\nPost-exploitation impact is characterized by arbitrary file reading restricted by specific application constraints. The attacker can disclose the contents of files located anywhere on the filesystem, provided the target file ends with -3grams.txt and its structure can be parsed successfully as token count lines by the reader. Affected versions include NLTK 3.9.4 through 3.10.2. The attack vector requires the user to load a malicious corpus package, shifting exploitation requirements to the delivery and ingestion phase of untrusted corpus data."
}