CVE-2026-63312
Received Received - Intake

Arbitrary Local File Read in NLTK StreamBackedCorpusView

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: VulnCheck

Description
NLTK before 3.10.0 contains an arbitrary local file read vulnerability in StreamBackedCorpusView that bypasses pathsec.ENFORCE by calling builtins.open() directly instead of pathsec.open(). Attackers who control the fileid argument can read arbitrary local files regardless of the ENFORCE setting, including sensitive system files and application credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-63312
EUVD
EUVD-2026-64333

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
nltk nltk to 3.10.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-63312 is an arbitrary local file read vulnerability in NLTK versions before 3.10.0. It affects the StreamBackedCorpusView class, which bypasses the pathsec.ENFORCE security mechanism by using Python's built-in open() function instead of the restricted pathsec.open(). Attackers controlling the fileid argument can read any local file, including sensitive system files or application credentials.

Detection Guidance

To detect this vulnerability, check the installed version of NLTK on your system. Run: pip show nltk. If the version is below 3.10.0, the system is vulnerable. Additionally, review applications using NLTK for user-controlled fileid arguments passed to StreamBackedCorpusView.

Impact Analysis

This vulnerability allows attackers to read arbitrary local files on your system, including sensitive files like /etc/passwd, application configurations, or credentials. It can be exploited in web applications, APIs, or NLP pipelines where user input influences the fileid parameter passed to NLTK corpus readers.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, or other regulations by enabling unauthorized access to sensitive data such as personal information, health records, or credentials. Exploitation may result in data breaches, violating confidentiality requirements and leading to legal or regulatory penalties.

Mitigation Strategies

Upgrade NLTK to version 3.10.0 or later immediately using: pip install --upgrade nltk. If upgrading is not possible, restrict access to NLTK data directories and avoid passing user-controlled fileid values to StreamBackedCorpusView.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63312. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart