CVE-2026-12072

Affected versions of the nltk package are vulnerable to Path Traversal due to unsanitized path construction in its NKJP corpus reader. The NKJPCorpusReader.add_root method concatenates the fileids argument directly onto the corpus root without stripping directory-traversal sequences, and the underlying NKJPCorpus_Header_View and XML_Tool classes then pass that unvalidated path straight into Python's builtin open() instead of the hardened CorpusReader.open() method, which means the package's own nltk.pathsec sandbox (including strict ENFORCE = True mode) is never consulted. An attacker who can influence the fileids value passed to reader methods such as header, raw, words, sents, or tagged_words can supply a traversal sequence to escape the corpus root, with header confirmed to return the parsed content of the out-of-root file, resulting in Arbitrary File Read of files elsewhere on the host.