5 matches found
GHSA-M42H-3232-VPV3 nltk: Arbitrary File Read via Path Traversal in nltk.data.load() through Percent-Encoded Sequences
Summary nltk.data.load and nltk.data.find resolve user-supplied resource names to filesystem paths using url2pathname, which decodes percent-encoded sequences e.g. %2e%2e to ... Path safety checks are performed on the raw, still-encoded string before decoding occurs. An attacker supplying %2e%2e...
nltk: Arbitrary File Read via Path Traversal in nltk.data.load() through Percent-Encoded Sequences
Summary nltk.data.load and nltk.data.find resolve user-supplied resource names to filesystem paths using url2pathname, which decodes percent-encoded sequences e.g. %2e%2e to ... Path safety checks are performed on the raw, still-encoded string before decoding occurs. An attacker supplying %2e%2e...
PT-2026-75984
Summary nltk.data.load and nltk.data.find resolve user-supplied resource names to filesystem paths using url2pathname, which decodes percent-encoded sequences e.g. %2e%2e to ... Path safety checks are performed on the raw, still-encoded string before decoding occurs. An attacker supplying %2e%2e...
GHSA-Q5H6-FCF5-49G9 Duplicate Advisory: Arbitrary File Read via Path Traversal in nltk.data.load() through Percent-Encoded Sequences
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-m42h-3232-vpv3. This link is maintained to preserve external references. Original Description NLTK version 3.9.4 is vulnerable to a path traversal attack due to an incomplete fix for GitHub Issue 3504. The...
