What is the CVSS score of CVE-2026-12243?

CVE-2026-12243 has a CVSS 3.0 base score of 7.5 (High). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.5%.

Which versions of NLTK are affected by CVE-2026-12243?

NLTK version 3.9.4 contains an arbitrary file disclosure vulnerability (CVE-2026-12243) enabling remote attackers to read sensitive files with no public exploit identified at time of analysis.. A patch is available.

Is there a public PoC exploit available for CVE-2026-12243?

Yes, a public proof-of-concept exploit is available for CVE-2026-12243. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate CVE-2026-12243?

Within 24 hours: Identify all systems using NLTK 3.9.4 via dependency scanning tools and restrict network access to affected services where possible. Within 7 days: Evaluate upgrade to a patched NLTK version once released or migrate to alternative NLP libraries (SpaCy, Transformers); implement strict input validation in code calling nltk.data.load() and nltk.data.find() to sanitize path parameters. Within 30 days: Complete migration or patching; deploy runtime monitoring for suspicious file access patterns from Python processes; document remediation completion and update security baselines.

NLTK CVE-2026-12243

EUVD-2026-40240 HIGH

Path Traversal (CWE-22)

2026-06-30 @huntr_ai

GHSA-m42h-3232-vpv3

GHSA-q5h6-fcf5-49g9 PYSEC-2026-597

Python Path Traversal Red Hat Nltk Nltk Nltk

7.5

CVSS 3.0 · Vendor: huntr_ai

Severity by source

Vendor (huntr_ai) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Where a host app forwards user input to NLTK loaders, exploitation is network-reachable, low-complexity, and unauthenticated, yielding high confidentiality (arbitrary file read) with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (huntr_ai).

CVSS VectorVendor: huntr_ai

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 30, 2026 - 01:26 vuln.today

CVE Published

Jun 30, 2026 - 00:14 cve.org

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

184 pypi packages depend on nltk (42 direct, 142 indirect)

Ecosystem-wide dependent count for version 3.9.4.

DescriptionCVE.org

NLTK version 3.9.4 is vulnerable to a path traversal attack due to an incomplete fix for GitHub Issue #3504. The _UNSAFE_NO_PROTOCOL_RE regex in nltk/data.py checks for literal ../ sequences but fails to account for percent-encoded traversal sequences such as ..%2f. The url2pathname() function decodes these sequences after the validation step, allowing an attacker to bypass the protection. This vulnerability enables an attacker to read arbitrary files accessible to the Python process by controlling the resource name parameter passed to nltk.data.load() or nltk.data.find(). The issue affects applications that rely on NLTK for resource loading, including NLP web applications, Jupyter notebooks, and CLI tools. The default pathsec.ENFORCE=False setting exacerbates the impact by not blocking the file read at the open() stage.

AnalysisAI

Arbitrary file disclosure in NLTK 3.9.4 lets remote attackers read any file accessible to the Python process by passing percent-encoded path-traversal sequences (e.g. ..%2f) into nltk.data.load() or nltk.data.find(). The flaw is an incomplete fix for GitHub Issue #3504: the _UNSAFE_NO_PROTOCOL_RE guard only matches literal ../ while url2pathname() decodes the encoded form after the check runs, so the validation is bypassed. No public exploit identified at time of analysis, though it was reported through a huntr.com bounty; it is not listed in CISA KEV and no EPSS score was supplied.

Technical ContextAI

NLTK (Natural Language Toolkit) is a widely used Python library for natural language processing whose data subsystem resolves named resources (corpora, models, tokenizers) into filesystem or URL paths. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). In nltk/data.py the _UNSAFE_NO_PROTOCOL_RE regular expression is intended to reject traversal by matching literal ../ substrings, but the subsequent url2pathname() call performs percent-decoding, so an input like ..%2f passes the regex as inert text and only becomes ../ after the security check has already approved it - a classic validate-then-decode ordering bug. The affected package per CPE is cpe:2.3:a:nltk:nltk/nltk. The library's pathsec.ENFORCE flag defaults to False, meaning the resolved path is not re-checked at the open() stage, removing the last line of defense before the file is read.

RemediationAI

No vendor-released patch identified at time of analysis - the input cites only the huntr.com bounty (https://huntr.com/bounties/39aa9354-54ca-4e77-96da-580eb1fe6ed1) and notes this is an incomplete fix for Issue #3504, with no corrected version number provided, so do not assume a tagged release resolves it; monitor the NLTK GitHub repository for a release above 3.9.4 and upgrade once published. As compensating controls: set pathsec.ENFORCE=True so the path is re-validated at the open() stage (trade-off: may reject legitimate resource names that resolve outside expected directories, so test resource loading after enabling). Most importantly, never pass user-controlled input directly to nltk.data.load() or nltk.data.find(); allowlist the specific resource names your application needs and reject any input containing % or path separators before it reaches NLTK (trade-off: requires code change in the host application but eliminates the attack surface). Run the Python process under a least-privilege account so an arbitrary read cannot reach sensitive files such as credentials or keys.