Description

NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on caller-controlled paths. Attackers can read or write files outside allowed sandbox roots through TransitionParser, AveragedPerceptron, PerceptronTagger, and maxent parameter APIs when pathsec is enabled.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.0",
  "pubDate": "2026-08-27T17:21:03.387Z",
  "pubdate": "2026-08-27T17:21:03.387Z",
  "executiveSummary": "NLTK versions up to 3.10.3 are susceptible to a critical path traversal vulnerability within its model-artifact management APIs.\nThe vulnerability originates from insecure file handling practices where the library executes raw file operations on user-supplied paths, effectively bypassing established pathsec security enforcement mechanisms.\nThis flaw grants an attacker the ability to perform unauthorized read or write operations on arbitrary files within the underlying host filesystem, extending beyond the intended sandbox root directories.\nAffected components include the TransitionParser, AveragedPerceptron, PerceptronTagger, and maxent parameter APIs.\nThe risk implication is significant, as it enables arbitrary file disclosure or the corruption of system-critical configuration files and data.\nExploitation requires the attacker to exert control over the input paths passed to these specific NLTK APIs, potentially leveraging the library in applications that expose model-loading or parameter-loading functionalities to untrusted user input.",
  "technicalDetails": "The root cause of this vulnerability lies in the failure of specific NLTK model-artifact APIs to maintain the integrity of pathsec security constraints. While the NLTK framework implements pathsec to restrict filesystem access to predefined sandboxed roots, the affected APIs bypass these safety checks by invoking low-level, raw file system operations directly on user-provided path inputs.\nThe vulnerability manifests within TransitionParser, AveragedPerceptron, PerceptronTagger, and the maxent parameter APIs. When these components receive a payload containing directory traversal sequences (e.g., '../'), the underlying logic fails to normalize or validate the path before passing it to internal file-handling routines. Consequently, the OS treats the malicious path as absolute or relative to the root directory, permitting unauthorized access to sensitive file locations.\nAttack flow typically proceeds as follows: 1) An attacker identifies an application endpoint or interface that utilizes one of the vulnerable NLTK classes (e.g., a service allowing users to upload or specify custom model/perceptron files). 2) The attacker crafts a request containing a malicious path string that utilizes traversal characters to escape the intended sandbox directory. 3) The target API processes the payload; due to the bypass of pathsec, the application performs an unsanitized file system read or write operation at the destination specified by the traversal string. 4) In a read scenario, this results in the leakage of sensitive local data or credentials. In a write scenario, this allows an attacker to overwrite critical binaries or configuration files, potentially leading to remote code execution or complete system compromise.\nThe affected versions include all NLTK versions through 3.10.3. The vulnerability does not inherently require authentication if the affected APIs are exposed through an unauthenticated interface, and it operates regardless of existing network-level perimeter defenses, as the vulnerability resides within the logic of the local file system interactions.\nPost-exploitation impact is severe, as the ability to write files allows for the injection of malicious serialized objects or the modification of application logic, while the ability to read files facilitates reconnaissance and the theft of sensitive keys or environment configuration data."
}