CVE-2026-0847

The vulnerability stems from inadequate sanitization of file paths within NLTK's WordListCorpusReader, TaggedCorpusReader, and BracketParseCorpusReader classes. An attacker can craft malicious file paths containing directory traversal sequences (e.g., ../..) to bypass intended access restrictions. This enables them to read sensitive files located outside the intended corpus directory, potentially exposing configuration files, source code, or other confidential data. The impact is particularly severe in environments where user-provided data is used to construct file paths within these classes, as this provides a direct attack vector. Successful exploitation could lead to data breaches, system compromise, and potentially further lateral movement within the affected network.

Applications and systems utilizing NLTK for natural language processing tasks, particularly those that accept user-provided file inputs, are at risk. This includes machine learning APIs, chatbots, and NLP pipelines. Developers who have built custom corpus readers or extended NLTK functionality without proper input validation are also at increased risk.

• python / server:

import os
import glob

# Check for suspicious file paths in NLTK corpus readers
corpus_root = '/path/to/nltk/corpus'
for filename in glob.glob(os.path.join(corpus_root, '**', '*')): # Recursive search
    if '..' in filename:
        print(f'Suspicious file path found: {filename}')

• linux / server:

# Monitor NLTK process for unusual file access patterns
journalctl -u nltk -f | grep -i 'open|read' | grep '..'

1. 2026-03-04Disclosure

   disclosure

1. Reserviert2026-01-10
2. Veröffentlicht2026-03-04
3. EPSS aktualisiert2026-03-23

The primary mitigation is to upgrade to a patched version of NLTK. The vendor has not released a specific fixed version as of this writing, but it is recommended to monitor the NLTK project's website and GitHub repository for updates. As a temporary workaround, implement strict input validation on any user-provided file paths used within NLTK CorpusReader classes. This should include whitelisting allowed characters and rejecting paths containing directory traversal sequences. Consider using a WAF or proxy to filter requests containing suspicious file path patterns. After upgrade, confirm by attempting to access a restricted file via a CorpusReader and verifying that access is denied.