7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-54293

CVE-2026-54293: NLTK: URL-Encoded Path Traversal in nltk.data.load() Allows Arbitrary Local File Read

NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. Prior to 3.10.0-rc1, nltk.data.load() in NLTK is vulnerable to path traversal via URL-encoded path separators and traversal segments when using the nltk: URL scheme. The unsafe-path regex check is performed before url2pathname() decodes the %xx sequences (a classic decode-after-check / TOCTOU-style flaw), allowing an attacker to bypass the protection documented in NLTK's SECURITY.md and read arbitrary files from the filesystem. While literal traversal strings such as ../../../etc/passwd are correctly blocked, encoded variants such as %2fetc%2fpasswd, %2e%2e%2f..., and ..%2f..%2f slip past the regex and are subsequently decoded into a real filesystem path. This vulnerability is fixed in 3.10.0-rc1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-54293

CVE-2026-54293:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
nltk	pip	<= 3.9.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic 'decode-after-check' path traversal flaw in NLTK's data loading mechanism. The root cause is that the security check to prevent path traversal was performed on the raw, URL-encoded resource string. Malicious input could use percent-encoded characters (e.g., %2f for /, %2e for .) to bypass this check. The url2pathname() function, used later in the process, would decode these characters, reassembling the malicious path and allowing an attacker to read arbitrary files on the local filesystem.

The analysis of the patch commit 7df10e6efa0417145e370aa42d8342faa6d244b8 confirms this. The fix involves introducing a new helper function, _assert_no_encoded_bypass, which explicitly decodes the resource name using urllib.parse.unquote and then applies the security regex (_UNSAFE_NO_PROTOCOL_RE) to the decoded string.

This new check is applied in two key vulnerable functions:

nltk.data.find(): This function, which is responsible for locating the data on the filesystem, now validates both the raw and decoded resource name.
nltk.data.normalize_resource_url(): This function, which processes nltk: scheme URLs, also incorporates the new check to prevent bypasses at the normalization stage.

The primary user-facing function and entry point for exploitation is nltk.data.load(), as demonstrated in the provided proof-of-concept. This function internally calls find(), triggering the vulnerable logic. Therefore, any of these three functions (load, find, normalize_resource_url) would likely appear in a runtime profile or stack trace during an exploit attempt. The fix ensures that any path traversal attempts, whether literal or URL-encoded, are caught and rejected.

Vulnerable functions

nltk.data.find

nltk/data.py

This function is responsible for finding the resource on the filesystem. It contained the flawed validation logic that checked for path traversal characters before URL decoding. An attacker could use URL-encoded characters to bypass the check. The patch added a call to `_assert_no_encoded_bypass` to check the decoded path, fixing the vulnerability.

nltk.data.normalize_resource_url

nltk/data.py

This function normalizes the resource URL. For `nltk:` URLs, it was vulnerable because it did not check for encoded path traversal characters before further processing. This contributed to the 'decode-after-check' flaw. The patch added a call to `_assert_no_encoded_bypass` to fix this.

nltk.data.load

nltk/data.py

This is the primary, user-facing entry point for the vulnerability. It accepts a resource URL from the user and passes it to other vulnerable functions (`find`, `normalize_resource_url`) for processing, leading to an arbitrary file read when a maliciously crafted, URL-encoded path is provided.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.