THREATOPS
THREAT OPS › Threat News › [GHSA] GHSA-m42h-3232-vpv3 (high) — nltk: Arbitrary File Read via Path Traversal in nltk.data.load() through Percent-Encoded Sequences

[GHSA] GHSA-m42h-3232-vpv3 (high) — nltk: Arbitrary File Read via Path Traversal in nltk.data.load() through Percent-Encoded Sequences

medgithub_advisoriesPublished 2026-08-13

GHSA-m42h-3232-vpv3 Severity: high CVE: CVE-2026-12243

nltk: Arbitrary File Read via Path Traversal in nltk.data.load() through Percent-Encoded Sequences

# Summary nltk.data.load() and nltk.data.find() resolve user-supplied resource names to filesystem paths using url2pathname(), which decodes percent-encoded sequences (e.g. %2e%2e to ..). Path safety checks are performed on the raw, still-encod

MITRE ATT&CK techniques

Indicators of compromise

Original source: https://github.com/advisories/GHSA-m42h-3232-vpv3