{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/vendors/natural-language-toolkit/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["NLTK (\u003c= 3.9.4)"],"_cs_severities":["high"],"_cs_tags":["path-traversal","cve-2026-12072","library-vulnerability"],"_cs_type":"advisory","_cs_vendors":["Natural Language Toolkit"],"content_html":"\u003cp\u003eThe Natural Language Toolkit (NLTK) version 3.9.4 and earlier contains a critical path-traversal vulnerability (CVE-2026-12072) within the \u003ccode\u003eNKJPCorpusReader\u003c/code\u003e class. The component fails to validate or sanitize the \u003ccode\u003efileids\u003c/code\u003e parameter used in its corpus reading methods (e.g., \u003ccode\u003eheader\u003c/code\u003e, \u003ccode\u003eraw\u003c/code\u003e, \u003ccode\u003ewords\u003c/code\u003e). Instead of utilizing the \u003ccode\u003enltk.pathsec\u003c/code\u003e security framework, which is designed to prevent directory traversal and enforce strict access control, \u003ccode\u003eNKJPCorpusReader\u003c/code\u003e relies on insecure string concatenation to build file paths and subsequently invokes Python's built-in \u003ccode\u003eopen()\u003c/code\u003e function.\u003c/p\u003e\n\u003cp\u003eThis architectural flaw persists even when \u003ccode\u003enltk.pathsec.ENFORCE = True\u003c/code\u003e is set, a configuration specifically intended to protect multi-tenant and web-based applications from unauthorized file system access. An attacker capable of influencing the input to these methods can escape the intended corpus directory, leading to unauthorized disclosure of sensitive files on the host system. The vulnerability affects a wide range of NLTK corpus readers that share the same insecure pattern of using raw file operations over the provided security API.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies an application endpoint or script that accepts user-supplied input used as a \u003ccode\u003efileids\u003c/code\u003e argument for NLTK's \u003ccode\u003eNKJPCorpusReader\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious path string containing directory traversal sequences (e.g., \u003ccode\u003e../../../../\u003c/code\u003e) to escape the configured corpus root directory.\u003c/li\u003e\n\u003cli\u003eThe application passes the malicious string into the \u003ccode\u003eNKJPCorpusReader.header()\u003c/code\u003e or related corpus reading method.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eNKJPCorpusReader\u003c/code\u003e performs plain string concatenation of the corpus root and the attacker-controlled \u003ccode\u003efileids\u003c/code\u003e without normalization or security validation.\u003c/li\u003e\n\u003cli\u003eThe resulting path points to a sensitive file on the host filesystem (e.g., \u003ccode\u003e/etc/passwd\u003c/code\u003e or configuration files).\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eNKJPCorpusReader\u003c/code\u003e method calls the Python built-in \u003ccode\u003eopen()\u003c/code\u003e function directly with the resolved malicious path.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003enltk.pathsec\u003c/code\u003e sandbox is never consulted, bypassing the \u003ccode\u003eENFORCE=True\u003c/code\u003e security configuration.\u003c/li\u003e\n\u003cli\u003eThe application returns the content of the unintended file to the attacker, resulting in unauthorized data exfiltration.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the arbitrary reading of files on the host operating system with the privileges of the service account running the NLTK-based application. This poses a significant risk to web and multi-tenant environments where NLTK is utilized to process untrusted user input. Exposure of local configuration files, API keys, or system credentials could lead to full system compromise. The vulnerability affects any software utilizing NLTK \u0026lt;= 3.9.4 for corpus analysis.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate NLTK to the latest version once a patch is released that addresses the \u003ccode\u003eNKJPCorpusReader\u003c/code\u003e path validation logic.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation for any user-controlled data intended to act as a file path or identifier within NLTK readers.\u003c/li\u003e\n\u003cli\u003eAudit application code for any custom use of \u003ccode\u003eos.path.join\u003c/code\u003e or string concatenation when constructing file paths passed to NLTK corpus objects, ensuring that \u003ccode\u003eFileSystemPathPointer.open()\u003c/code\u003e is used instead of the built-in \u003ccode\u003eopen()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eRestrict the privileges of the system user running the NLTK-dependent application to the minimum necessary directory access using OS-level controls (e.g., AppArmor, SELinux, or container volume restrictions).\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-31T19:30:03Z","date_published":"2026-07-31T19:30:03Z","id":"https://feed.craftedsignal.io/briefs/2026-07-nltk-path-traversal/","summary":"A path-traversal vulnerability in NLTK's NKJPCorpusReader allows attackers to read arbitrary files by bypassing the nltk.pathsec security sandbox.","title":"NLTK NKJPCorpusReader Path Traversal Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-07-nltk-path-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Natural Language Toolkit","version":"https://jsonfeed.org/version/1.1"}