Path Traversal in ANTLR4 Token Vocab Parser

Executive Summary

CVE-2026-13503 is a path traversal vulnerability in ANTLR4 version 4.13.2, specifically in the function getImportedVocabFile of the tokenVocab Grammar Option Handler. The vulnerability occurs because the tool constructs file paths by directly concatenating directory and filename inputs without validating for malicious path traversal sequences like ".." or absolute paths.

An attacker can exploit this by submitting a malicious grammar file with a tokenVocab option set to a sensitive filename while specifying a library directory that includes the target file's location. When ANTLR4 processes the grammar, it reads the specified .tokens file and exposes its contents in error messages, leading to information disclosure.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability impacts confidentiality by allowing an attacker to read arbitrary files on the system remotely without any privileges or user interaction.

The attacker can gain access to sensitive information contained in files that should not be exposed, which can lead to information disclosure.

The vulnerability does not affect the integrity or availability of the system.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if ANTLR4 is processing grammar files with the tokenVocab option that may include path traversal sequences such as ".." or absolute paths. Monitoring for error messages that expose contents of unexpected .tokens files can also indicate exploitation attempts.

You can search for suspicious grammar files or commands invoking ANTLR4 with the -lib option pointing to directories outside the expected scope. For example, on a Unix-like system, you might use commands like:

• grep -r 'tokenVocab' /path/to/grammar/files
• grep -r '\.tokens' /path/to/grammar/files
• audit or monitor ANTLR4 command executions for usage of the -lib option with unexpected directory paths.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation involves validating the vocabName parameter against a strict identifier pattern to prevent path traversal sequences and ensuring that the constructed file path remains within the intended library directory.

Additionally, restrict or monitor the usage of the -lib option in ANTLR4 to prevent attackers from specifying arbitrary directories that could lead to reading sensitive files.

If possible, update or patch ANTLR4 to a version that includes this validation or apply custom fixes to the getImportedVocabFile function to sanitize input paths.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in ANTLR4 allows arbitrary file read through path traversal, leading to information disclosure. This exposure of sensitive file contents can impact confidentiality requirements mandated by standards such as GDPR and HIPAA.

Since the vulnerability compromises confidentiality by exposing potentially sensitive data without authorization, it may result in non-compliance with regulations that require protection of personal or sensitive information.

However, the vulnerability does not affect integrity or availability, focusing the compliance impact primarily on confidentiality controls.

Useful 0 Not Useful 0