CVE-2026-0847
Received Received - Intake
Path Traversal in NLTK CorpusReader Enables Arbitrary File Read

Publication date: 2026-03-04

Last updated on: 2026-04-28

Assigner: huntr.dev

Description
A vulnerability in NLTK versions up to and including 3.9.2 allows arbitrary file read via path traversal in multiple CorpusReader classes, including WordListCorpusReader, TaggedCorpusReader, and BracketParseCorpusReader. These classes fail to properly sanitize or validate file paths, enabling attackers to traverse directories and access sensitive files on the server. This issue is particularly critical in scenarios where user-controlled file inputs are processed, such as in machine learning APIs, chatbots, or NLP pipelines. Exploitation of this vulnerability can lead to unauthorized access to sensitive files, including system files, SSH private keys, and API tokens, and may potentially escalate to remote code execution when combined with other vulnerabilities.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-04
Last Modified
2026-04-28
Generated
2026-05-27
AI Q&A
2026-03-04
EPSS Evaluated
2026-05-25
NVD
CVE-2026-0847
EUVD
EUVD-2026-9475
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
nltk nltk to 3.9.2 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability exists in NLTK versions up to and including 3.9.2 and involves multiple CorpusReader classes such as WordListCorpusReader, TaggedCorpusReader, and BracketParseCorpusReader. These classes do not properly sanitize or validate file paths, which allows an attacker to perform path traversal attacks. By exploiting this, an attacker can read arbitrary files on the server.

The vulnerability is especially critical when user-controlled file inputs are processed, for example in machine learning APIs, chatbots, or natural language processing pipelines.


How can this vulnerability impact me? :

Exploitation of this vulnerability can lead to unauthorized access to sensitive files on the server, including system files, SSH private keys, and API tokens.

Additionally, when combined with other vulnerabilities, it may allow an attacker to escalate privileges and achieve remote code execution.


How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:

I don't know


How can this vulnerability be detected on my network or system? Can you suggest some commands?

I don't know


What immediate steps should I take to mitigate this vulnerability?

I don't know


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart