CVE-2026-12243 is a high-severity vulnerability affecting nltk versions < 3.10.0 in the nltk library with a CVSS score of 7.5, allowing an attacker to read arbitrary files via path traversal through percent-encoded sequences in the nltk.data.load function. This occurs because url2pathname, which decodes these sequences, is called after path safety checks, enabling an attacker to bypass all validation and access sensitive data by supplying %2e%2e instead of.. The flaw type is CWE-22, with an attack vector of network (AV:N) and a low attack complexity (AC:L). An attacker who controls the resource name passed to nltk.data.load can read any file the process has permission to access - credentials, environment files, SSH private keys, application config files, etc. This affects any application that passes user-controlled input to nltk.data.load or nltk.data.find, posing a significant business impact due to potential data exposure and unauthorized access.
We recommend you to update nltk to version 3.10.0.[/subscribe_to_unlock_form]
CVE-2026-12243 is a high-severity vulnerability affecting nltk versions < 3.10.0 in the nltk library with a CVSS score of 7.5, allowing an attacker to read arbitrary files via path traversal through percent-encoded sequences in the nltk.data.load function. This occurs because url2pathname, which decodes these sequences, is called after path safety checks, enabling an attacker to bypass all validation and access sensitive data by supplying %2e%2e instead of.. The flaw type is CWE-22, with an attack vector of network (AV:N) and a low attack complexity (AC:L). An attacker who controls the resource name passed to nltk.data.load can read any file the process has permission to access - credentials, environment files, SSH private keys, application config files, etc. This affects any application that passes user-controlled input to nltk.data.load or nltk.data.find, posing a significant business impact due to potential data exposure and unauthorized access.
We recommend you to update nltk to version 3.10.0.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]