CVE-2026-54293

CVE-2026-54293 · NLTK: URL-Encoded Path Traversal in nltk.data.load() Allows Arbitrary Local File Read

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. Prior to 3.10.0-rc1, nltk.data.load() in NLTK is vulnerable to path traversal via URL-encoded path separators and traversal segments when using the nltk: URL scheme. The unsafe-path regex check is performed before url2pathname() decodes the %xx sequences (a classic decode-after-check / TOCTOU-style flaw), allowing an attacker to bypass the protection documented in NLTK's SECURITY.md and read arbitrary files from the filesystem. While literal traversal strings such as ../../../etc/passwd are correctly blocked, encoded variants such as %2fetc%2fpasswd, %2e%2e%2f..., and ..%2f..%2f slip past the regex and are subsequently decoded into a real filesystem path. This vulnerability is fixed in 3.10.0-rc1.

CVSS 7.5 · Alta · EPSS 0,6% · Corrección disponible

Publicación

2026-06-22T17:25:05.611Z

Actualización

2026-09-09T12:04:56.577Z

Pila tecnológica: system · python

Comprueba tu servidor →