CVE-2026-12243 is a path traversal vulnerability in NLTK version 3.9.4 caused by an incomplete fix for a prior issue. The regex `_UNSAFE_NO_PROTOCOL_RE` in nltk/data.py checks for literal '../' sequences but does not detect percent-encoded traversal sequences like '..%2f'. Since the `url2pathname()` function decodes these sequences after the validation step, an attacker can bypass the pathname restriction and cause arbitrary file reads by controlling the resource name parameter passed to `nltk.data.load()` or `nltk.data.find()`. The vulnerability is exacerbated by the default setting `pathsec.ENFORCE=False`, which does not block file reads at the open() stage. This issue affects any application relying on NLTK for resource loading.

An attacker can read arbitrary files accessible to the Python process by exploiting the path traversal vulnerability in NLTK 3.9.4. This can lead to unauthorized disclosure of sensitive information. There is no indication of integrity or availability impact. The vulnerability is remotely exploitable without privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid using NLTK version 3.9.4 in untrusted environments or restrict access to sensitive files. Consider setting `pathsec.ENFORCE=True` if applicable to block unauthorized file reads at the open() stage. Monitor official NLTK channels for updates and apply patches once released.