Path Traversal in NLTK CrubadanCorpusReader

Executive Summary

CVE-2026-71514 is a path traversal vulnerability in NLTK versions 3.9.4 through 3.10.2 affecting the CrubadanCorpusReader class. The _load_lang_ngrams method improperly handles file paths by joining the corpus root with user-controlled crubadan_code values from corpus table.txt files. It uses Python's built-in open() instead of a pathsec-validated opener, allowing attackers who control corpus packages to read files outside the intended corpus directory if the crubadan_code contains absolute paths ending in -3grams.txt.

Useful 0 Not Useful 0

Detection Guidance

Check NLTK version with pip show nltk. If version is between 3.9.4 and 3.10.2, the system is vulnerable. Inspect corpus packages for malformed crubadan_code values in table.txt files that could trigger path traversal.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker who controls a corpus package to read sensitive files on your system outside the NLTK corpus directory. The impact is limited to files with paths ending in -3grams.txt that parse as token count lines. An attacker could potentially access configuration files, logs, or other sensitive data if they can manipulate corpus files in your NLTK installation.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance by enabling unauthorized access to sensitive data, potentially violating GDPR's data protection requirements or HIPAA's patient privacy rules. The path traversal could lead to unauthorized disclosure of personal or protected health information if attackers access files containing such data through this vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade NLTK to version 3.10.3 or later. Review and sanitize corpus packages to ensure crubadan_code values are relative paths. Remove any suspicious corpus packages that may contain malicious table.txt files.

Useful 0 Not Useful 0