NLTK Path Traversal Vulnerability Before 3.10.0

Executive Summary

CVE-2026-65915 is a logic bug in NLTK versions before 3.10.0 where the FileSystemPathPointer.open() method's sandbox validation fails. The check compares a normalized path against itself, always returning true, which disables the security mechanism. Attackers can exploit this by passing malicious file:// URLs to nltk.data.load() to read arbitrary files accessible to the process user.

Useful 0 Not Useful 0

Detection Guidance

Check NLTK version with pip show nltk. If version is below 3.10.0, the system is vulnerable. Inspect code using nltk.data.load() or nltk.data.find() for user-controlled input handling.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to read sensitive files on your system, including credentials and configuration files, if your application uses NLTK and accepts user-controlled input for nltk.data.load() or nltk.data.find(). This could lead to data breaches, unauthorized access, or further exploitation of your system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations may face legal penalties, reputational damage, and loss of trust if such breaches occur due to this flaw.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade NLTK to version 3.10.0 or later immediately. Review and restrict user input to nltk.data.load() and nltk.data.find() functions. Implement path validation using os.path.commonpath() against permitted directories.

Useful 0 Not Useful 0