Log in Start free

Vulnerability · Published Mar 9, 2026 · Assigned by @huntr_ai

CVE-2026-0846Arbitrary File Read via Absolute Path Input in nltk.util.filestring()

High 7.5

In plain English

A high-severity path traversal in nltk/nltk from nltk. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.6%top 51.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability in the `filestring()` function of the `nltk.util` module in nltk version 3.9.2 allows arbitrary file read due to improper validation of input paths. The function directly opens files specified by user input without sanitization, enabling attackers to access sensitive system files by providing absolute paths or traversal paths. This vulnerability can be exploited locally or remotely, particularly in scenarios where the function is used in web APIs or other interfaces that accept user-supplied input.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12nltkno fix listedDEBIAN-CVE-2026-0846
Debian:13nltkno fix listedDEBIAN-CVE-2026-0846
Debian:14nltk3.9.3-1DEBIAN-CVE-2026-0846
PyPInltkno fix listedPYSEC-2026-97
PyPInltk3.9.3GHSA-h8wq-7xc4-p3qx
Ubuntu:25.10nltkno fix listedUBUNTU-CVE-2026-0846
Ubuntu:26.10nltkno fix listedUBUNTU-CVE-2026-0846

Affected products (as reported)

VendorProductVersions
nltk nltk/nltk unspecified – through latest

Weakness: CWE-36, CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References