https://feed.craftedsignal.io/products/nltk--3.9.4/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 31 Jul 2026 19:30:03 +0000https://feed.craftedsignal.io/briefs/2026-07-nltk-path-traversal/Fri, 31 Jul 2026 19:30:03 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-nltk-path-traversal/A path-traversal vulnerability in NLTK's NKJPCorpusReader allows attackers to read arbitrary files by bypassing the nltk.pathsec security sandbox.The Natural Language Toolkit (NLTK) version 3.9.4 and earlier contains a critical path-traversal vulnerability (CVE-2026-12072) within the NKJPCorpusReader class. The component fails to validate or sanitize the fileids parameter used in its corpus reading methods (e.g., header, raw, words). Instead of utilizing the nltk.pathsec security framework, which is designed to prevent directory traversal and enforce strict access control, NKJPCorpusReader relies on insecure string concatenation to build file paths and subsequently invokes Python's built-in open() function.

This architectural flaw persists even when nltk.pathsec.ENFORCE = True is set, a configuration specifically intended to protect multi-tenant and web-based applications from unauthorized file system access. An attacker capable of influencing the input to these methods can escape the intended corpus directory, leading to unauthorized disclosure of sensitive files on the host system. The vulnerability affects a wide range of NLTK corpus readers that share the same insecure pattern of using raw file operations over the provided security API.

Attack Chain

1. Attacker identifies an application endpoint or script that accepts user-supplied input used as a fileids argument for NLTK's NKJPCorpusReader.
2. Attacker crafts a malicious path string containing directory traversal sequences (e.g., ../../../../) to escape the configured corpus root directory.
3. The application passes the malicious string into the NKJPCorpusReader.header() or related corpus reading method.
4. NKJPCorpusReader performs plain string concatenation of the corpus root and the attacker-controlled fileids without normalization or security validation.
5. The resulting path points to a sensitive file on the host filesystem (e.g., /etc/passwd or configuration files).
6. The NKJPCorpusReader method calls the Python built-in open() function directly with the resolved malicious path.
7. The nltk.pathsec sandbox is never consulted, bypassing the ENFORCE=True security configuration.
8. The application returns the content of the unintended file to the attacker, resulting in unauthorized data exfiltration.

Impact

Successful exploitation allows for the arbitrary reading of files on the host operating system with the privileges of the service account running the NLTK-based application. This poses a significant risk to web and multi-tenant environments where NLTK is utilized to process untrusted user input. Exposure of local configuration files, API keys, or system credentials could lead to full system compromise. The vulnerability affects any software utilizing NLTK <= 3.9.4 for corpus analysis.

Recommendation

• Update NLTK to the latest version once a patch is released that addresses the NKJPCorpusReader path validation logic.
• Implement strict input validation for any user-controlled data intended to act as a file path or identifier within NLTK readers.
• Audit application code for any custom use of os.path.join or string concatenation when constructing file paths passed to NLTK corpus objects, ensuring that FileSystemPathPointer.open() is used instead of the built-in open().
• Restrict the privileges of the system user running the NLTK-dependent application to the minimum necessary directory access using OS-level controls (e.g., AppArmor, SELinux, or container volume restrictions).

]]>highadvisorypath-traversalcve-2026-12072library-vulnerabilityhttps://feed.craftedsignal.io/briefs/2026-07-nltk-ssrf-bypass/Fri, 31 Jul 2026 19:29:56 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-nltk-ssrf-bypass/A DNS rebinding vulnerability in the NLTK pathsec module allows attackers to bypass SSRF filters and access restricted internal resources by manipulating hostname resolution during the validation and connection phases.The NLTK library (version 3.9.4 and earlier) contains a critical SSRF filter bypass vulnerability in its nltk.pathsec module, specifically within the urlopen function and underlying utilities like nltk.data.load. The vulnerability stems from a race condition or logic flaw involving independent DNS resolutions: validate_network_url performs an initial check against forbidden IP ranges (loopback, private, link-local), but the subsequent HTTP connection initiated by urllib performs a second, independent DNS resolution.

An attacker can exploit this via DNS rebinding by providing a domain that returns a legitimate public IP during the first check, and an unauthorized internal or loopback IP during the second check. Even when nltk.pathsec.ENFORCE is set to True, the security control is rendered ineffective. This allows for non-blind SSRF, enabling attackers to exfiltrate data from internal interfaces, administrative consoles, or cloud metadata services (e.g., 169.254.169.254), leading to potential credential theft or deeper network penetration.

Attack Chain

1. Attacker sets up a malicious authoritative DNS server for a domain (e.g., rebind.attacker.test) with a TTL of 0.
2. Attacker provides the malicious domain as an input to a function utilizing nltk.pathsec.urlopen.
3. nltk.pathsec calls _resolve_hostname, which performs the first DNS lookup; the attacker's server returns a benign public IP.
4. The validation logic compares the benign IP against blocklists, deems the URL safe, and allows the request to proceed.
5. urlopen passes the raw hostname to the urllib connection layer.
6. urllib initiates a second DNS lookup to establish the actual TCP connection.
7. The attacker's DNS server returns a loopback or internal private IP for this second resolution.
8. The application establishes a connection to the sensitive internal resource and returns the response body to the attacker.

Impact

The vulnerability facilitates full-response (non-blind) SSRF. Attackers can read data from internal services protected by perimeter firewalls. In cloud-hosted environments, this is frequently leveraged to query instance metadata services for IAM roles, API keys, and service tokens, leading to full compromise of the affected application's identity and subsequent unauthorized access to broader cloud infrastructure.

Recommendation

• Update NLTK to the latest patched version that pins the resolved IP address across the validation and connection phases.
• If patching is not immediately possible, restrict outbound network access from servers running NLTK processing tasks to prevent connections to internal RFC1918 and link-local address spaces.
• Implement host-level egress filtering (e.g., using iptables or local firewall rules) to explicitly block NLTK-related service accounts from initiating connections to 127.0.0.1 or 169.254.169.254.

]]>highadvisoryssrfdns-rebindingvulnerabilitypath-traversalarbitrary-file-readlibrary-vulnerability