Path traversal in Natural Language Toolkit - #VU159479
Published: November 5, 2026
Vulnerability details
The vulnerability allows arbitrary local file reads and writes outside the directories permitted by Natural Language Toolkit's filesystem security mechanism. An attacker who can influence the tab_dir argument to load_maxent_params() or save_maxent_params() can bypass filesystem containment, reading model parameter files from unauthorized directories or creating and overwriting parameter files outside approved roots. The practical impact depends on how the application exposes these APIs and the filesystem permissions of the NLTK process.
The vulnerability exists due to both functions constructing filesystem paths from caller-controlled tab_dir values and accessing those paths with Python's built-in open() without NLTK's pathsec validation. A remote attacker can supply an outside-root directory when an application exposes control of tab_dir through these APIs. The loading function reads files from the selected directory, while the saving function creates or overwrites files there. These operations bypass the intended directory restrictions even when pathsec.ENFORCE is enabled.
The affected functions are implemented in nltk/classify/maxent.py. The loading operation constructs paths including <tab_dir>/weights.txt, <tab_dir>/mapping.tab, <tab_dir>/labels.txt, and <tab_dir>/alwayson.tab; the saving operation writes model parameter files beneath the supplied directory. Thus, the attacker controls the directory used for these parameter-file operations rather than an unrestricted filename. Applications relying on nltk.pathsec to restrict access to permitted filesystem roots are exposed when attacker-influenced directories reach these functions.