CVE-2026-62385 Overview
CVE-2026-62385 is a path traversal vulnerability in the Natural Language Toolkit (NLTK) affecting versions before 3.10.0. The flaw resides in FramenetCorpusReader and NKJPCorpusReader, where unsafe selectors or poisoned index state allow attackers to parse XML files outside the corpus root. Attackers can invoke frame_by_name, doc, lu, and header methods with crafted parameters to read arbitrary XML files accessible to the application process. The vulnerability is classified under CWE-73: External Control of File Name or Path.
Critical Impact
Attackers can read arbitrary XML-parseable files on the host filesystem accessible to the NLTK application, exposing sensitive configuration and application data.
Affected Products
- NLTK (Natural Language Toolkit) versions prior to 3.10.0
- Applications embedding FramenetCorpusReader with attacker-influenced selectors
- Applications embedding NKJPCorpusReader with attacker-influenced index state
Discovery Timeline
- 2026-08-22 - CVE-2026-62385 published to NVD
- 2026-08-24 - Last updated in NVD database
Technical Details for CVE-2026-62385
Vulnerability Analysis
NLTK exposes corpus readers that resolve XML resources by combining a corpus root path with caller-supplied selectors. In FramenetCorpusReader, methods including frame_by_name, doc, lu, and header accept parameters that are concatenated into filesystem paths without adequate normalization or containment checks against the corpus root.
In NKJPCorpusReader, the reader trusts index state that can be poisoned to reference paths outside the intended corpus directory. When downstream methods parse these entries, the XML loader dereferences arbitrary paths on disk.
Any XML-parseable file readable by the application process becomes a candidate for disclosure. Applications that accept user input for corpus queries, or that load corpora from untrusted sources, are directly exposed.
Root Cause
The corpus readers construct file paths using externally influenced values and pass them to XML parsing routines without validating that the resolved absolute path remains inside the corpus root. Traversal sequences such as ../ and absolute paths bypass the intended sandbox. This maps to CWE-73, external control of file name or path.
Attack Vector
Exploitation requires the attacker to influence the selector arguments passed to vulnerable methods, or to place a poisoned index file that the reader later consumes. In a typical attack path, a web service exposes NLTK-backed functionality that maps user input to frame_by_name or doc. The attacker submits a value containing traversal segments or an absolute path pointing at a target XML file, and the service returns parsed content from that file. Consult the GitHub Security Advisory GHSA-568f-pv23-39p4 and the VulnCheck Path Traversal Advisory for further technical detail.
Detection Methods for CVE-2026-62385
Indicators of Compromise
- Application logs showing NLTK corpus reader calls with selector values containing ../, ..\, or absolute filesystem paths
- Access to XML files outside the configured corpus root directory by the Python process hosting NLTK
- Unexpected reads of sensitive XML files such as configuration, credentials stores, or SAML assertions by the application user
Detection Strategies
- Inventory Python environments for NLTK versions below 3.10.0 using pip show nltk or software bill of materials tooling
- Instrument corpus reader entry points to log resolved absolute paths and compare against the declared corpus root
- Deploy Web Application Firewall (WAF) rules that reject traversal sequences and absolute path characters in parameters mapped to NLTK selectors
Monitoring Recommendations
- Monitor file access telemetry for the NLTK application user, alerting on reads outside the corpus directory
- Track outbound responses from services wrapping NLTK for unexpectedly large XML payloads or non-corpus content
- Correlate exception traces from xml.etree or lxml originating in framenet or nkjp modules with preceding user input
How to Mitigate CVE-2026-62385
Immediate Actions Required
- Upgrade NLTK to version 3.10.0 or later in all Python environments that expose corpus reader functionality
- Audit application code that calls frame_by_name, doc, lu, or header on FramenetCorpusReader, and any NKJPCorpusReader usage, for untrusted input
- Reject or sanitize any user-supplied selector containing path separators, traversal segments, or absolute path prefixes
Patch Information
The maintainers addressed the vulnerability in NLTK 3.10.0. See the GitHub Security Advisory GHSA-568f-pv23-39p4 for the fix commits and the VulnCheck advisory for exploitation context. Upgrade using pip install --upgrade nltk>=3.10.0.
Workarounds
- Restrict selector arguments to a strict allowlist of known frame names, document identifiers, and lexical units
- Load corpora only from trusted, integrity-verified sources to prevent poisoned index files reaching NKJPCorpusReader
- Run NLTK-backed services under a dedicated low-privilege user with filesystem access limited to the corpus directory
# Configuration example
pip install --upgrade 'nltk>=3.10.0'
pip show nltk | grep -i version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
