CVE-2026-0846
Arbitrary File Read via Absolute Path Input in nltk.util.filestring()
A vulnerability in the filestring() function of the nltk.util module in nltk version 3.9.2 allows arbitrary file read due to improper validation of input paths. The function directly opens files specified by user input without sanitization, enabling attackers to access sensitive system files by providing absolute paths or traversal paths. This vulnerability can be exploited locally or remotely, particularly in scenarios where the function is used in web APIs or other interfaces that accept user-supplied input.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List
Arbitrary File Read via Absolute Path Input in nltk.util.filestring()
A vulnerability in the filestring() function of the nltk.util module in nltk version 3.9.2 allows arbitrary file read due to improper validation of input paths. The function directly opens files specified by user input without sanitization, enabling attackers to access sensitive system files by providing absolute paths or traversal paths. This vulnerability can be exploited locally or remotely, particularly in scenarios where the function is used in web APIs or other interfaces that accept user-supplied input.
- Record
CVE-2026-0846- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 3.0
- 8.6 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L - Weakness
- CWE-36, CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2026-10350
A vulnerability in the filestring() function of the nltk.util module in nltk version 3.9.2 allows arbitrary file read due to improper validation of input paths. The function directly opens files specified by user input without sanitization, enabling attackers to access sensitive system files by providing absolute paths or traversal paths. This vulnerability can be exploited locally or remotely, particularly in scenarios where the function is used in web APIs or other interfaces that accept user-supplied input.
- Record
EUVD-2026-10350- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-h8wq-7xc4-p3qx
NLTK has Arbitrary File Read via Absolute Path Input in nltk.util.filestring()
A vulnerability in the filestring() function of the nltk.util module in nltk version 3.9.2 allows arbitrary file read due to improper validation of input paths. The function directly opens files specified by user input without sanitization, enabling attackers to access sensitive system files by providing absolute paths or traversal paths. This vulnerability can be exploited locally or remotely, particularly in scenarios where the function is used in web APIs or other interfaces that accept user-supplied input.
- Record
GHSA-h8wq-7xc4-p3qx- CVSS 3.0
- 8.6 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L - Weakness
- CWE-36
- Updated
- 2026-11-02
NVD
A vulnerability in the filestring() function of the nltk.util module in nltk version 3.9.2 allows arbitrary file read due to improper validation of input paths. The function directly opens files specified by user input without sanitization, enabling attackers to access sensitive system files by providing absolute paths or traversal paths. This vulnerability can be exploited locally or remotely, particularly in scenarios where the function is used in web APIs or other interfaces that accept user-supplied input.
- Record
CVE-2026-0846- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 3.0
- 8.6 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L - Weakness
- CWE-36, CWE-22
- Updated
- 2026-11-02
OSV
Arbitrary File Read via Absolute Path Input in nltk.util.filestring()
A vulnerability in the filestring() function of the nltk.util module in nltk version 3.9.2 allows arbitrary file read due to improper validation of input paths. The function directly opens files specified by user input without sanitization, enabling attackers to access sensitive system files by providing absolute paths or traversal paths. This vulnerability can be exploited locally or remotely, particularly in scenarios where the function is used in web APIs or other interfaces that accept user-supplied input.
- Record
CVE-2026-0846- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-36
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-0846
A vulnerability in the filestring() function of the nltk.util module in nltk version 3.9.2 allows arbitrary file read due to improper validation of input paths. The function directly opens files specified by user input without sanitization, enabling attackers to access sensitive system files by providing absolute paths or traversal paths. This vulnerability can be exploited locally or remotely, particularly in scenarios where the function is used in web APIs or other interfaces that accept user-supplied input.
- Record
DEBIAN-CVE-2026-0846- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Show 4 moreShow less
OSVGHSA-h8wq-7xc4-p3qx
NLTK has Arbitrary File Read via Absolute Path Input in nltk.util.filestring()
A vulnerability in the filestring() function of the nltk.util module in nltk version 3.9.2 allows arbitrary file read due to improper validation of input paths. The function directly opens files specified by user input without sanitization, enabling attackers to access sensitive system files by providing absolute paths or traversal paths. This vulnerability can be exploited locally or remotely, particularly in scenarios where the function is used in web APIs or other interfaces that accept user-supplied input.
- Record
GHSA-h8wq-7xc4-p3qx- CVSS 3.0
- 8.6 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L - Weakness
- CWE-36
- Updated
- 2026-11-02
OSVPYSEC-2026-97
A vulnerability in the filestring() function of the nltk.util module in nltk version 3.9.2 allows arbitrary file read due to improper validation of input paths. The function directly opens files specified by user input without sanitization, enabling attackers to access sensitive system files by providing absolute paths or traversal paths. This vulnerability can be exploited locally or remotely, particularly in scenarios where the function is used in web APIs or other interfaces that accept user-supplied input.
- Record
PYSEC-2026-97- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-0846
A vulnerability in the filestring() function of the nltk.util module in nltk version 3.9.2 allows arbitrary file read due to improper validation of input paths. The function directly opens files specified by user input without sanitization, enabling attackers to access sensitive system files by providing absolute paths or traversal paths. This vulnerability can be exploited locally or remotely, particularly in scenarios where the function is used in web APIs or other interfaces that accept user-supplied input.
- Record
UBUNTU-CVE-2026-0846- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 3.0
- 8.6 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L - Updated
- 2026-11-02
OSVUSN-8302-1 No score
nltk vulnerabilities
It was discovered that NLTK incorrectly validated file paths when opening files using the nltk.util module. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-0846)
It was discovered that NLTK incorrectly validated file paths in multiple CorpusReader classes. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-0847)
It was discovered that NLTK did not properly validate external Java archive files loaded by StanfordSegmenter. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-0848)
It was discovered that NLTK's WordNet browser application incorrectly handled user-supplied input. An attacker could possibly use this issue to perform a cross-site scripting attack. (CVE-2026-33230)
It was discovered that NLTK's WordNet browser application did not restrict access to the shutdown endpoint. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-33231)
It was discovered that NLTK's downloader did not validate path attributes in remote XML index files. An attacker could possibly use this issue to create or overwrite arbitrary files. (CVE-2026-33236)
- Record
USN-8302-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
nltkPyPI |
before 3.9.3 | 3.9.3 |
nltkDebian:12 |
All versions, plus listed versions 3.10.0-13.10.1-13.10.3-13.8-13.8.1-1 Show 4 moreShow less3.9.1-13.9.1-23.9.2-13.9.3-1 |
None known |
nltkDebian:13 |
All versions, plus listed versions 3.10.0-13.10.1-13.10.3-13.9.1-23.9.2-13.9.3-1 |
None known |
nltkDebian:14 |
before 3.9.3-1, plus listed versions 3.9.1-23.9.2-1 |
3.9.3-1 |
nltkPyPI |
before 3.9.3, plus listed versions 0.80.90.9.30.9.40.9.5 Show 45 moreShow less0.9.60.9.70.9.80.9.92.0.12.0.1rc12.0.1rc2-git2.0.1rc32.0.1rc42.0.22.0.32.0.42.0.52.0b42.0b52.0b62.0b72.0b82.0b93.0.03.0.0b13.0.0b23.0.13.0.23.0.33.0.43.0.53.13.23.2.13.2.23.2.33.2.43.2.53.33.43.4.13.4.23.4.33.4.43.4.53.53.5b13.63.6.1 |
3.9.3 |
nltkPyPI |
through 3.9.2, plus listed versions 0.80.90.9.30.9.40.9.5 Show 45 moreShow less0.9.60.9.70.9.80.9.92.0.12.0.1rc12.0.1rc2-git2.0.1rc32.0.1rc42.0.22.0.32.0.42.0.52.0b42.0b52.0b62.0b72.0b82.0b93.0.03.0.0b13.0.0b23.0.13.0.23.0.33.0.43.0.53.13.23.2.13.2.23.2.33.2.43.2.53.33.43.4.13.4.23.4.33.4.43.4.53.53.5b13.63.6.1 |
None known |
nltkUbuntu:Pro:14.04:LTS |
before 2.0~b9-0ubuntu4.1~esm6, plus listed versions 2.0~b9-0ubuntu42.0~b9-0ubuntu4.1~esm22.0~b9-0ubuntu4.1~esm42.0~b9-0ubuntu4.1~esm5 |
2.0~b9-0ubuntu4.1~esm6 |
nltkUbuntu:Pro:16.04:LTS |
before 3.1-1ubuntu0.1+esm4, plus listed versions 3.0.4-13.0.5-13.1-13.1-1ubuntu0.13.1-1ubuntu0.1+esm13.1-1ubuntu0.1+esm23.1-1ubuntu0.1+esm3 |
3.1-1ubuntu0.1+esm4 |
nltkUbuntu:Pro:18.04:LTS |
before 3.2.5-1ubuntu0.1+esm4, plus listed versions 3.2.4-13.2.5-13.2.5-1ubuntu0.13.2.5-1ubuntu0.1+esm13.2.5-1ubuntu0.1+esm23.2.5-1ubuntu0.1+esm3 |
3.2.5-1ubuntu0.1+esm4 |
nltkUbuntu:Pro:20.04:LTS |
before 3.4.5-2ubuntu0.1~esm4, plus listed versions 3.4.5-13.4.5-23.4.5-2ubuntu0.1~esm13.4.5-2ubuntu0.1~esm23.4.5-2ubuntu0.1~esm3 |
3.4.5-2ubuntu0.1~esm4 |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
nltkUbuntu:Pro:22.04:LTS |
before 3.7-1ubuntu0.1~esm2, plus listed versions 3.5-13.6.5-13.6.7-13.7-13.7-1ubuntu0.1~esm1 |
3.7-1ubuntu0.1~esm2 |
nltkUbuntu:Pro:24.04:LTS |
before 3.8.1-1ubuntu0.1~esm2, plus listed versions 3.8.1-13.8.1-1ubuntu0.1~esm1 |
3.8.1-1ubuntu0.1~esm2 |
nltkUbuntu:25.10 |
All versions, plus listed versions 3.9.1-2 |
None known |
nltkUbuntu:26.10 |
All versions, plus listed versions 3.9.2-13.9.3-13.10.0-13.10.1-13.10.3-1 |
None known |
nltkUbuntu:Pro:26.04:LTS |
before 3.9.2-1ubuntu0.1~esm2, plus listed versions 3.9.1-23.9.1-2build13.9.2-13.9.2-1ubuntu0.1~esm1 |
3.9.2-1ubuntu0.1~esm2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-0846 is a high vulnerability (CVSS 8.6) in Nltk, published March 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.59%, the 48th percentile. Fixed in nltk 3.9.3.
References
huntr.com/bounties/007b84f8-418e-4300-99d0-bf504c2f97eb
access.redhat.com/security/cve/CVE-2026-0846
bugzilla.redhat.com/show_bug.cgi?id=2445826
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0846.json
Show 18 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-0846
github.com/nltk/nltk/pull/3485
security-tracker.debian.org/tracker/CVE-2026-0846
ubuntu.com/security/CVE-2026-0846
cve.org/CVERecord?id=CVE-2026-0846
Left out here: 25 versions. The JSON record has them.