CVE-2026-54293

Affected versions of the Natural Language Toolkit (NLTK) package are vulnerable to Path Traversal due to improper handling of URL-encoded path separators and traversal segments. The `nltk.data.load()` function fails to properly sanitize path inputs before decoding them with `url2pathname()`, allowing encoded traversal patterns to bypass regex checks. An attacker can exploit this vulnerability by providing a specially crafted URL-encoded path, enabling arbitrary file read access on the system, potentially exposing sensitive files such as `/etc/passwd` or `/proc/self/environ`.