NLTK CVE-2026-0847

Exploitation requires that the target application uses NLTK CorpusReader classes (WordListCorpusReader, TaggedCorpusReader, or BracketParseCorpusReader specifically) and passes user-controlled input as file path parameters to these readers without sanitization. Most critically vulnerable are NLP APIs, chatbots, machine learning pipelines, or web applications where corpus names, file paths, or data source identifiers are derived from HTTP request parameters, API payloads, or user uploads. Default NLTK installations that only load built-in corpora from hardcoded paths are NOT vulnerable. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no special conditions for network exploitation once the vulnerable code path exists - no authentication, user interaction, or complex setup required. Exploitation is LIMITED to environments where application logic connects external input to CorpusReader instantiation, which is deployment-specific and not universal to all NLTK users.

CVSS 7.5 (High) reflects the unauthenticated network attack vector with zero complexity and high confidentiality impact (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N), indicating straightforward exploitation for information disclosure. However, the EPSS score of 0.25% (below median) suggests limited observed exploitation attempts, likely because successful attacks require specific deployment patterns where NLTK processes untrusted file path inputs - not universal to all NLTK installations. The huntr.com security bounty disclosure provides technical details that could accelerate exploit development. Real-world risk is HIGHEST for public-facing NLP APIs, chatbots, and ML platforms that accept user-supplied corpus names or file references without application-layer validation. The description's mention of potential RCE escalation path is concerning but not confirmed from available data - the CVSS vector shows only confidentiality impact (I:N), not integrity. Organizations should prioritize patching if NLTK handles any external input, but assess whether their specific deployment actually exposes CorpusReader functionality to untrusted sources. The 'Authentication Bypass' tag appears misapplied - this is pure path traversal, not auth bypass, though file disclosure could leak credentials enabling subsequent bypass.

An attacker identifies a public-facing sentiment analysis API that accepts a 'corpus_name' parameter to customize language models. By submitting a crafted request with corpus_name set to '../../../etc/passwd' or '../../../home/user/.ssh/id_rsa', the attacker exploits NLTK's WordListCorpusReader to traverse directories and retrieve the file contents in the API response or error message. With SSH keys or API tokens extracted, the attacker pivots to lateral movement or account takeover. Public exploit details from the huntr.com bounty disclosure provide attackers with specific CorpusReader methods and payload examples to replicate the attack.