Path Traversal in NLTK Before 3.10.4

Executive Summary

NLTK before version 3.10.4 has a path traversal flaw in save_maxent_params() and load_maxent_params() functions. These functions bypass the pathsec filesystem restriction, allowing attackers who control the tab_dir argument to read or overwrite model parameter files outside allowed directories by directly using Python's open() function.

Useful 0 Not Useful 0

Detection Guidance

Check NLTK version with pip show nltk. If version is <=3.10.3, the system is vulnerable. Inspect code using save_maxent_params() or load_maxent_params() in nltk/classify/maxent.py for direct open() calls without pathsec validation.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to access or modify sensitive files on your system, potentially leading to data leaks, unauthorized changes, or system compromise if they control the tab_dir argument in affected NLTK functions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection principles or HIPAA's security requirements for protected health information, potentially resulting in compliance breaches and legal penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade NLTK to the latest version. If upgrading is not possible, apply patches from commits f2556f9 and 2a92b71. Ensure all calls to save_maxent_params() and load_maxent_params() use pathsec.open() instead of open().

Useful 0 Not Useful 0