{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3anltknltk3.9.4/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:nltk:nltk:3.9.4:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-12243"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["nltk"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eNLTK (Natural Language Toolkit) versions prior to 3.10.0 contain a critical path traversal vulnerability (CVE-2026-12243) in the \u003ccode\u003enltk.data.load()\u003c/code\u003e and \u003ccode\u003enltk.data.find()\u003c/code\u003e functions. The vulnerability exists because the library performs security validation checks on a user-supplied \u003ccode\u003eresource_name\u003c/code\u003e string before decoding percent-encoded sequences using \u003ccode\u003eurl2pathname()\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eAn attacker can bypass these safety checks by supplying encoded traversal sequences (e.g., \u003ccode\u003e%2e%2e\u003c/code\u003e instead of \u003ccode\u003e..\u003c/code\u003e). Because the security validation logic operates on the encoded input, the malicious path is permitted. Once the internal validation is cleared, \u003ccode\u003eurl2pathname()\u003c/code\u003e decodes the sequence to \u003ccode\u003e..\u003c/code\u003e, enabling the function to resolve paths outside of the intended NLTK data directory. This allows an attacker to read any file on the filesystem accessible by the application process, including sensitive credentials, configuration files, and SSH keys.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthorized access to sensitive system files. In environments where an application exposes functionality that accepts user-defined resource paths to the NLTK library (such as an NLTK-based web scraper or NLP analysis service), an unauthenticated or low-privileged attacker can exfiltrate arbitrary files. This may lead to credential theft, full server compromise, or unauthorized access to protected application data.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the \u003ccode\u003enltk\u003c/code\u003e library to version 3.10.0 or later immediately to patch CVE-2026-12243.\u003c/li\u003e\n\u003cli\u003eAudit applications using \u003ccode\u003enltk.data.load()\u003c/code\u003e or \u003ccode\u003enltk.data.find()\u003c/code\u003e to determine if user-controlled input is passed directly to these functions without external sanitization.\u003c/li\u003e\n\u003cli\u003eIf upgrading is not immediately possible, implement a wrapper around \u003ccode\u003enltk.data.load()\u003c/code\u003e that manually performs URL decoding (\u003ccode\u003eurllib.parse.unquote\u003c/code\u003e) on the input path before any other processing or validation occurs.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-14T02:03:36Z","date_published":"2026-08-14T02:03:36Z","id":"https://feed.craftedsignal.io/briefs/2026-08-nltk-path-traversal/","summary":"NLTK versions prior to 3.10.0 are vulnerable to path traversal (CVE-2026-12243) due to improper sequence decoding in nltk.data.load(), allowing attackers to read arbitrary files.","title":"Arbitrary File Read in NLTK via Path Traversal","url":"https://feed.craftedsignal.io/briefs/2026-08-nltk-path-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:nltk:nltk:3.9.4:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}