GHSA-6hm5-jgcp-p838

Summary

A path-traversal vulnerability in NKJPCorpusReader allows an attacker who can influence the fileids argument of its public read methods (header, raw, words, sents, tagged_words) to read files outside the corpus root. The reader builds the file path with no containment check and opens it with the builtin open(), so it bypasses NLTK's nltk.pathsec sandbox — including the strict ENFORCE = True mode that SECURITY.md recommends for web/multi-tenant deployments. header() returns the parsed content of the out-of-root file to the caller (arbitrary file read).

Details

SECURITY.md promises that file access is "validated against allowed NLTK data directories" and that with nltk.pathsec.ENFORCE = True "unauthorized file access … will raise PermissionError." That guarantee is enforced via FileSystemPathPointer.open() / CorpusReader.open(), which call nltk.pathsec.validate_path(...).

NKJPCorpusReader never uses that protected path. In nltk/corpus/reader/nkjp.py:

• add_root() builds the path by plain string concatenation with no normalization or containment check:

  def add_root(self, fileid):          # lines 96-102
      if self.root in fileid:
          return fileid                # attacker-controlled value returned unchanged
      return self.root + fileid        # plain concat, '..' not stripped
  

• The header view appends a fixed basename and passes the string straight into the corpus view (which opens it with the builtin open()):

  class NKJPCorpus_Header_View(XMLCorpusView):   # line 181
      def __init__(self, filename, **kwargs):
          XMLCorpusView.__init__(self, filename + "header.xml", self.tagspec)  # line 189
  

• The other modes reach the filesystem through XML_Tool, which uses a raw os.path.join (not the hardened FileSystemPathPointer.join()) and the...