Path traversal in Natural Language Toolkit - #VU159478
Published: November 5, 2026
Vulnerability details
The vulnerability allows an attacker who controls model-path input to Natural Language Toolkit's BllipParser to cause the application process to open and read attacker-selected filesystem resources outside the allowed NLTK data directories. Targets can include local configuration or credential files readable by the process. Disclosure of file contents depends on how the application exposes parser errors or results, while file existence, size, and open behavior can provide an oracle. Selecting a FIFO, socket, device, directory, or oversized regular file can instead cause blocking or unbounded memory consumption, reducing performance or stalling the worker performing the parse.
The vulnerability exists due to missing pathsec validation in nltk/parse/bllip.py before caller-controlled paths are passed to the native bllipparser extension. The constructor's parser_model, reranker_features, and reranker_weights arguments reach load_parser_model() or load_reranker_model() without confinement to NLTK data roots. A remote attacker can exploit an application that accepts remotely supplied model-path input and forwards it to these APIs, provided the optional bllipparser package is installed. The alternative from_unified_model_dir() entry point is also affected: the third-party get_unified_model_parameters() function derives model paths without NLTK data-root validation, and those paths subsequently reach the same unchecked constructor and native loaders.
The native extension performs its own operating-system-level opens and reads to interpret the selected resources as model data. NLTK's centralized nltk.pathsec validation provides validate_tool_path() for precisely this external-tool access boundary, but BllipParser does not invoke it. Consequently, this path bypasses the name-safety checks that reject option-shaped, URL-shaped, and traversal inputs, as well as protections against symbolic links and files that are not regular and single-linked. It also bypasses model-size restrictions. Exploitation requires attacker influence over a model path passed by the application; merely using BllipParser with trusted paths does not establish that condition. The demonstrated primitive is control over which filesystem resource the process opens and reads, rather than unconditional disclosure of its contents to the attacker.