CVE-2026-0847

CVE-2026-0847 — NLTK Несколько классов CorpusReader: произвольное чтение файлов через обход пути -orange?style=for-the-badge Обзор Поле| Детали ---|--- CVE ID| CVE-2026-0847 Пакет| nltk Natural Language Toolkit Реестр| PyPI Затронутые версии| = 3.9.2 Тип уязвимости| CWE-22: Обход пути Path...

EUVD-2026-64314

NLTK: Symlink escape in CorpusReader allows arbitrary local file read outside the corpus root...

NLTK: Symlink escape in CorpusReader allows arbitrary local file read outside the corpus root

Summary nltk.corpus.reader.api.CorpusReader.open can be used to read files outside the intended corpus root via a symlink placed inside that root. Although NLTK blocks absolute paths and .. traversal, the current boundary check is only lexical and does not account for symlink resolution. This lea...

GHSA-R6GQ-WHWQ-MVG9 NLTK: Symlink escape in CorpusReader allows arbitrary local file read outside the corpus root

Summary nltk.corpus.reader.api.CorpusReader.open can be used to read files outside the intended corpus root via a symlink placed inside that root. Although NLTK blocks absolute paths and .. traversal, the current boundary check is only lexical and does not account for symlink resolution. This lea...

SUSE CVE-2026-70626

NLTK versions before 3.9.4 contain a symlink escape vulnerability in CorpusReader.open that allows local attackers to read arbitrary files outside the corpus root. The vulnerability exists because path validation is lexical and does not account for symlink resolution, enabling attackers to place...

CVE-2026-70626

A flaw was found in NLTK. This vulnerability allows a local attacker to read arbitrary files outside of the intended directory. By placing symbolic links symlinks within the corpus root, an attacker can bypass path validation in the CorpusReader.open function, which does not properly account for...

Duplicate Advisory: Symlink escape in CorpusReader allows arbitrary local file read outside the corpus root

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-r6gq-whwq-mvg9. This link is maintained to preserve external references. Original Description NLTK versions before 3.9.4 contain a symlink escape vulnerability in CorpusReader.open that allows local attackers to...

PYSEC-2026-3732

NLTK versions before 3.9.4 contain a symlink escape vulnerability in CorpusReader.open that allows local attackers to read arbitrary files outside the corpus root. The vulnerability exists because path validation is lexical and does not account for symlink resolution, enabling attackers to place...

CVE-2026-70626

NLTK versions before 3.9.4 contain a symlink escape vulnerability in CorpusReader.open that allows local attackers to read arbitrary files outside the corpus root. The vulnerability exists because path validation is lexical and does not account for symlink resolution, enabling attackers to place...

CVE-2026-70626

NLTK versions before 3.9.4 contain a symlink escape vulnerability in CorpusReader.open that allows local attackers to read arbitrary files outside the corpus root. The vulnerability exists because path validation is lexical and does not account for symlink resolution, enabling attackers to place...

UBUNTU-CVE-2026-70626

NLTK versions before 3.9.4 contain a symlink escape vulnerability in CorpusReader.open that allows local attackers to read arbitrary files outside the corpus root. The vulnerability exists because path validation is lexical and does not account for symlink resolution, enabling attackers to place...

CVE-2026-70626 NLTK before 3.9.4 Symlink Escape via CorpusReader

NLTK versions before 3.9.4 contain a symlink escape vulnerability in CorpusReader.open that allows local attackers to read arbitrary files outside the corpus root. The vulnerability exists because path validation is lexical and does not account for symlink resolution, enabling attackers to place...

CVE-2026-70626

NLTK versions before 3.9.4 are affected by a symlink escape vulnerability in CorpusReader.open() . The root cause is that path validation is purely lexical and does not resolve symlinks, allowing a local attacker to place a symlink inside the corpus root to read arbitrary files outside the intend...

CVE-2026-70626 NLTK before 3.9.4 Symlink Escape via CorpusReader

NLTK versions before 3.9.4 contain a symlink escape vulnerability in CorpusReader.open that allows local attackers to read arbitrary files outside the corpus root. The vulnerability exists because path validation is lexical and does not account for symlink resolution, enabling attackers to place...

CVE-2026-70626 NLTK before 3.9.4 Symlink Escape via CorpusReader

NLTK versions before 3.9.4 contain a symlink escape vulnerability in CorpusReader.open that allows local attackers to read arbitrary files outside the corpus root. The vulnerability exists because path validation is lexical and does not account for symlink resolution, enabling attackers to place...

PT-2026-79569

Name of the Vulnerable Software and Affected Versions NLTK versions prior to 3.9.4 Description A symlink escape issue exists in the CorpusReader.open function. This occurs because path validation is performed lexically and fails to account for symlink resolution. Consequently, a local attacker ca...

GHSA-68J8-PQ59-FQGM NLTK has a Path Traversal issue

A vulnerability in NLTK versions up to and including 3.9.2 allows arbitrary file read via path traversal in multiple CorpusReader classes, including WordListCorpusReader, TaggedCorpusReader, and BracketParseCorpusReader. These classes fail to properly sanitize or validate file paths, enabling...

PYSEC-2026-98

A vulnerability in NLTK versions up to and including 3.9.2 allows arbitrary file read via path traversal in multiple CorpusReader classes, including WordListCorpusReader, TaggedCorpusReader, and BracketParseCorpusReader. These classes fail to properly sanitize or validate file paths, enabling...

Directory Traversal

Overview nltk is a Natural Language Toolkit NLTK is a Python package for natural language processing. Affected versions of this package are vulnerable to Directory Traversal due to improper sanitization of file paths in the CorpusReader classes. An attacker can gain unauthorized access to sensiti...

CVE-2026-0847: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability in NLTK versions up to and including 3.9.2 allows arbitrary file read via path traversal in multiple CorpusReader classes, including WordListCorpusReader, TaggedCorpusReader, and BracketParseCorpusReader. These classes fail to properly sanitize or validate file paths, enabling...