CVE-2026-79674
NLTK 3.10.2 Path Traversal via corpus-reader constructors
CVSS Score
8.2
EPSS Score
0.0%
EPSS Percentile
0th
NLTK versions before 3.10.3 contain a path sandbox bypass vulnerability in corpus-reader constructors that allows attackers to read files outside the intended data root. Attackers can supply arbitrary corpus root paths to LinThesaurusCorpusReader and PanLexLiteCorpusReader constructors to access filesystem content and SQLite databases outside the pathsec sandbox boundary.
| CWE | CWE-73 |
| Vendor | nltk |
| Product | nltk |
| Published | Aug 25, 2026 |
| Last Updated | Aug 25, 2026 |
Stay Ahead of the Next One
Get instant alerts for nltk nltk
Be the first to know when new high vulnerabilities affecting nltk nltk are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
None
Affected Versions
nltk / nltk
0 < 3.10.3
References
Credits
🔍 nguyencanhthuong