CVE-2026-62385: NLTK 3.9.4 Path Traversal via FrameNet and NKJP Readers
Summary
Published nltk==3.9.4 still contains several XML-reader entrypoints that build parser paths from caller-controlled selectors or trusted-looking index state without preserving the corpus-root boundary.
Details
- Vulnerability type: Path traversal and trusted-root bypass - Affected component: FramenetCorpusReader.framebyname, FramenetCorpusReader.doc, FramenetCorpusReader.lu, NKJPCorpusReader.header - Affected versions: Published 3.9.4 reproduced. Current source v3.10.0-rc2 acted as a negative control and blocked the same payloads. - Patched versions: Patched in version 3.10.0, which includes the path-safety rejections seen in the release candidate. - Root cause: Stable reader paths still construct raw XML filenames from unsafe selectors, poisoned index state, or unsafe file identifiers.
I confirmed four public stable entrypoints return parsed outside-root content: a parent-segment traversal frame name, a poisoned fulltext index filename, a poisoned LU id, and an unsafe NKJP header file identifier. Current source rejects the same payloads with explicit path-safety errors, which shows the bug is real but version-scoped to the published stable package.
PoC
Preconditions - The application exposes FrameNet or NKJP reader APIs while trusting NLTK to keep XML parsing inside a corpus root.
Steps 1. Create a minimal FrameNet or NKJP corpus root and place attacker-chosen XML files outside that root. 2. Feed unsafe selectors or poisoned index state into the relevant public stable 3.9.4 APIs. 3. Observe framebyname, doc, lu(...).exemplars, or header return parsed outside-root values. 4. Run the same payloads against current source and observe explicit path-safety rejections.
Minimal reproducible excerpt
text framenetframedefinition FRAMELEAK framenetdoctext DOCLEAK framenetlutext LULEAK nkjpheadertitle HEADERLEAK
Impact
Applications that process attacker-influenced FrameNet or NKJP corpus selectors or state can be made to parse XML outside the trusted corpus root through normal public reader responses.
Remediation
Keep these reader paths on the same root-confinement model as CorpusReader.open() and nltk.pathsec. Reject unsafe path components before constructing filenames from frame names, document filenames, LU ids, or NKJP file identifiers.
Resources
- https://github.com/nltk/nltk/blob/3.9.4/nltk/corpus/reader/framenet.py#L1366-L1369 - https://github.com/nltk/nltk/blob/3.9.4/nltk/corpus/reader/framenet.py#L1456-L1460 - https://github.com/nltk/nltk/blob/3.9.4/nltk/corpus/reader/framenet.py#L1803-L1810 - https://github.com/nltk/nltk/blob/3.9.4/nltk/corpus/reader/nkjp.py#L96-L103 - https://github.com/nltk/nltk/blob/3.9.4/nltk/corpus/reader/nkjp.py#L251-L256 - https://github.com/nltk/nltk/blob/v3.10.0-rc2/nltk/corpus/reader/framenet.py#L1388-L1399 - https://github.com/nltk/nltk/blob/v3.10.0-rc2/nltk/corpus/reader/nkjp.py#L96-L128
Other sources
NLTK versions before 3.10.0 contain a path traversal vulnerability in FramenetCorpusReader and NKJPCorpusReader that allows attackers to parse XML files outside the corpus root by supplying unsafe selectors or poisoned index state. Attackers can exploit framebyname, doc, lu, and header methods with crafted parameters to read arbitrary XML files accessible to the application.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/nltkto a version that resolves this vulnerability.Fixed in 3.10.0 - Upgrade
Upgrade
nltkto a version that resolves this vulnerability.Fixed in 3.10.0 - Compensating control
If upgrading is not immediately possible, keep FrameNet/NKJP reader usage on the same root-confinement model as `CorpusReader.open()` / `nltk.pathsec` and reject unsafe path components (e.g., in `FramenetCorpusReader.frame_by_name`, `FramenetCorpusReader.doc`, `FramenetCorpusReader.lu`, and `NKJPCorpusReader.header`) before constructing parser filenames from attacker-controlled selectors or poisoned index state.
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using NLTK versions before 3.10.0 are exposed if they use FramenetCorpusReader or NKJPCorpusReader and allow attacker-influenced selectors or index state to reach the affected reader methods.
What does an attacker need to exploit the vulnerability?
An attacker needs to supply crafted parameters to the frame_by_name, doc, lu, or header methods, or influence poisoned index state. No authentication or user interaction is required according to the provided severity vector, but exploitation has high attack complexity.
What can an attacker access if exploitation succeeds?
The attacker can cause the application to parse XML files outside the intended corpus root. This may disclose arbitrary XML files that are accessible to the application process; the provided data does not indicate integrity or availability impact.
How can I determine whether my deployment is affected?
Check whether the application uses an NLTK release before 3.10.0 and invokes FramenetCorpusReader or NKJPCorpusReader methods such as frame_by_name, doc, lu, or header with untrusted selector values or attacker-influenced index data.
What should be done if upgrading is not immediately possible?
Do not allow untrusted input to control selectors passed to frame_by_name, doc, lu, or header, and prevent untrusted parties from modifying or supplying corpus index state. Restrict the application's access to sensitive XML files where possible.