HIGH 7.5 GitHub
CVE-2026-12243
nltk: Arbitrary File Read via Path Traversal in nltk.data.load() through Percent-Encoded Sequences
# Summary
nltk.data.load() and nltk.data.find() resolve user-supplied resource names to filesystem paths using url2pathname(), which decodes percent-encoded sequences (e.g. %2e%2e to ..). Path safety checks are performed on the raw, still-encoded string before decoding occurs. An attacker supplying %2e%2e instead of .. bypasses all path validation and reads arbitrary files outside the NLTK data directory.
# Vulnerable Code
nltk/data.py - find() function:
url2pathname() decodes %2e%2e -> .. AFT
Affected Products
- pip/nltk < 3.10.0
References
- https://github.com/advisories/GHSA-m42h-3232-vpv3
- https://github.com/nltk/nltk/security/advisories/GHSA-m42h-3232-vpv3
- https://nvd.nist.gov/vuln/detail/CVE-2026-12243
- https://github.com/nltk/nltk/issues/3504
This high severity vulnerability with a CVSS score of 7.5 was published on 2026-08-13 via GitHub. Affected: pip/nltk < 3.10.0.
vulnfeed aggregates 10812 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.