CVE-2026-54293
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
NLTK prior to 3.10.0-rc1 is vulnerable to path traversal in nltk.data.load() when using the nltk: URL scheme. The regex check runs before URL decoding, allowing an attacker to bypass protection and read arbitrary files from the filesystem.
Risk Assessment
An attacker can remotely read sensitive system files (e.g., /etc/passwd) without authorization, leading to data leakage and potential privilege escalation.
Recommendation
Immediately upgrade NLTK to version 3.10.0-rc1 or later. If upgrading is not possible, avoid using the nltk: URL scheme in nltk.data.load() with externally supplied data.
Original NVD description (English source)
NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. Prior to 3.10.0-rc1, nltk.data.load() in NLTK is vulnerable to path traversal via URL-encoded path separators and traversal segments when using the nltk: URL scheme. The unsafe-path regex check is performed before url2pathname() decodes the %xx sequences (a classic decode-after-check / TOCTOU-style flaw), allowing an attacker to bypass the protection documented in NLTK's SECURITY.md and read arbitrary files from the filesystem. While literal traversal strings such as ../../../etc/passwd are correctly blocked, encoded variants such as %2fetc%2fpasswd, %2e%2e%2f..., and ..%2f..%2f slip past the regex and are subsequently decoded into a real filesystem path. This vulnerability is fixed in 3.10.0-rc1.