CVE-2026-12243 is a path traversal vulnerability in NLTK 3.9.4 caused by an incomplete fix for a previous issue. The regex `_UNSAFE_NO_PROTOCOL_RE` in `nltk/data.py` only checks for literal '../' sequences but does not detect percent-encoded traversal sequences like '..%2f'. Since `url2pathname()` decodes these sequences after validation, an attacker can bypass the pathname restriction and cause arbitrary file reads via the `resource_name` parameter in `nltk.data.load()` or `nltk.data.find()`. The vulnerability is exacerbated by the default setting `pathsec.ENFORCE=False`, which does not block file reads at the open() call.

An attacker can read arbitrary files accessible to the Python process by supplying crafted resource names that include percent-encoded path traversal sequences. This can lead to unauthorized disclosure of sensitive information in applications that use NLTK for resource loading. The vulnerability does not allow code execution or denial of service but poses a confidentiality risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider manually validating and sanitizing resource names passed to `nltk.data.load()` and `nltk.data.find()`. Additionally, enabling stricter enforcement of pathname restrictions if configurable (e.g., setting `pathsec.ENFORCE=True`) may reduce risk. Monitor official NLTK channels for updates and apply patches once released.