CVE-2026-63312: NLTK Path Traversal Vulnerability

CVE-2026-63312 Overview

CVE-2026-63312 is an arbitrary local file read vulnerability in the Natural Language Toolkit (NLTK) affecting versions before 3.10.0. The flaw resides in the StreamBackedCorpusView class, which calls Python's builtins.open() directly instead of the security-enforcing pathsec.open() wrapper. This bypass renders the pathsec.ENFORCE protection ineffective. Attackers who control the fileid argument passed to the corpus view can read arbitrary files on the host, including system files and application credentials. The vulnerability is classified under [CWE-22] Path Traversal.

Critical Impact
Attackers controlling the fileid parameter can read sensitive local files such as /etc/passwd, private keys, and application configuration containing credentials, regardless of pathsec.ENFORCE settings.

Affected Products

NLTK (Natural Language Toolkit) versions prior to 3.10.0
Python applications using StreamBackedCorpusView with untrusted fileid input
Downstream libraries and services embedding vulnerable NLTK releases

Discovery Timeline

2026-08-22 - CVE-2026-63312 published to the National Vulnerability Database
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-63312

Vulnerability Analysis

NLTK ships a security helper module named pathsec intended to gate filesystem access through a centralized pathsec.open() function. When pathsec.ENFORCE is set, this wrapper validates and restricts which paths library code may open. The StreamBackedCorpusView class provides lazy access to token streams backed by files on disk.

The vulnerable code path invokes builtins.open() directly on the caller-supplied fileid value. This call sidesteps the pathsec.open() validation logic entirely. As a result, the ENFORCE policy is never consulted, and no path canonicalization or allow-list check occurs before the file handle is created.

Any code that forwards untrusted input into an NLTK corpus reader inherits an arbitrary file read primitive. This is exploitable in web services, notebooks, and pipelines that expose corpus configuration to users.

Root Cause

The root cause is inconsistent enforcement of the pathsec abstraction across NLTK's I/O surface. StreamBackedCorpusView was not migrated to use pathsec.open(), leaving a gap between the documented security control and the actual file-opening behavior. The fileid argument accepts absolute paths and path traversal sequences without normalization.

Attack Vector

An attacker supplies a crafted fileid value, such as an absolute path to /etc/shadow, a path traversal string like ../../../../etc/passwd, or a path to application secrets. When NLTK instantiates the StreamBackedCorpusView, the underlying builtins.open() call resolves the attacker-controlled path and returns file contents to the caller. Refer to the GitHub Security Advisory GHSA-x5ph-mj9p-rfr8 and the VulnCheck Advisory on NLTK for further technical detail.

Detection Methods for CVE-2026-63312

Indicators of Compromise

Python processes opening unexpected sensitive files such as /etc/passwd, /etc/shadow, ~/.ssh/id_rsa, or .env files while executing NLTK corpus routines.
Application logs showing fileid parameters containing absolute paths or ../ traversal sequences.
NLTK corpus reader calls with paths outside the configured NLTK_DATA directory.

Detection Strategies

Enumerate installed NLTK versions across development, CI, and production environments using pip show nltk and flag any version below 3.10.0.
Perform static analysis of Python code to locate calls to StreamBackedCorpusView or corpus readers where the fileid originates from user-controlled input.
Instrument Python file I/O with audit hooks (sys.addaudithook) to log open events triggered from nltk.corpus.reader modules.

Monitoring Recommendations

Alert on Python worker processes reading files outside their expected working directory or data corpus path.
Correlate web application request logs with subsequent file-open events referencing sensitive system paths.
Monitor egress traffic from application servers for exfiltration patterns following anomalous file reads.

How to Mitigate CVE-2026-63312

Immediate Actions Required

Upgrade NLTK to version 3.10.0 or later in all environments, including container images and locked dependency files.
Audit application code for any location where user-controllable data flows into NLTK corpus fileid arguments and add explicit allow-list validation.
Rotate credentials and secrets that may have been readable by NLTK-hosting processes if exploitation is suspected.

Patch Information

The maintainers addressed the issue in NLTK 3.10.0 by routing StreamBackedCorpusView file access through pathsec.open(), restoring the ENFORCE guarantee. See the GitHub Security Advisory GHSA-x5ph-mj9p-rfr8 for the fix commit and version details.

Workarounds

Never pass untrusted input directly to NLTK corpus reader constructors; validate fileid values against an explicit allow-list of filenames.
Restrict the process user's filesystem permissions so NLTK cannot read sensitive files even if the bypass is triggered.
Run NLTK-consuming services inside a sandbox or container with a read-only, minimal filesystem scoped to the required corpus directory.

bash

# Upgrade NLTK to the patched release
pip install --upgrade 'nltk>=3.10.0'

# Verify the installed version
python -c "import nltk; print(nltk.__version__)"