CVE-2026-12243— NLTK 路径遍历漏洞

Path Traversal via Percent-Encoding in nltk.data.find() and nltk.data.load()

NLTK version 3.9.4 is vulnerable to a path traversal attack due to an incomplete fix for GitHub Issue #3504. The `_UNSAFE_NO_PROTOCOL_RE` regex in `nltk/data.py` checks for literal `../` sequences but fails to account for percent-encoded traversal sequences such as `..%2f`. The `url2pathname()` function decodes these sequences after the validation step, allowing an attacker to bypass the protection. This vulnerability enables an attacker to read arbitrary files accessible to the Python process by controlling the resource name parameter passed to `nltk.data.load()` or `nltk.data.find()`. The issue affects applications that rely on NLTK for resource loading, including NLP web applications, Jupyter notebooks, and CLI tools. The default `pathsec.ENFORCE=False` setting exacerbates the impact by not blocking the file read at the `open()` stage.

N/A

对路径名的限制不恰当(路径遍历)

NLTK 路径遍历漏洞

NLTK是NLTK组织开源的一个自然语言工具包。用于支持自然语言处理的研究和开发。 NLTK 3.9.4版本存在路径遍历漏洞，该漏洞源于路径遍历攻击，由于对GitHub Issue #3504的修复不完整，_UNSAFE_NO_PROTOCOL_RE正则表达式仅检查字面的../序列，未考虑百分比编码的遍历序列如..%2f，url2pathname()函数在验证步骤后解码这些序列，导致攻击者绕过保护，通过控制传递给nltk.data.load()或nltk.data.find()的资源名称参数，读取Pyth

N/A

N/A