CVE-2026-0846
What it is
A vulnerability in the `filestring()` function of the `nltk.util` module in nltk version 3.9.2 allows arbitrary file read due to improper validation of input paths. The function directly opens files specified by user input without sanitization, enabling attackers to access sensitive system files by providing absolute paths or traversal paths. This vulnerability can be exploited locally or remotely, particularly in scenarios where the function is used in web APIs or other interfaces that accept user-supplied input.
At a glance
- Exploitability
- Can be exploited over the network without logging in. High risk of data exposure.
- Exploit odds
- 0.6% chance of exploitation in the next 30 days (EPSS).
- Fix
- A patch, advisory or fixed version is referenced. Upgrade or apply it.
Timeline
- PublishedDisclosed publicly on CVE.org and NVD
- Last updatedMost recent change to the record
Details
- Published
- Last modified
- Exploit probability
- 0.6% · EPSS, next 30 days
- Weakness
- CWE-36
- Record status
- Modified
Affected
- Nltk 3.9.2
Attack profile CVSS 3.1 · 7.5
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Fix and advisories
- https://huntr.com/bounties/007b84f8-418e-4300-99d0-bf504c2f97eb
- https://huntr.com/bounties/007b84f8-418e-4300-99d0-bf504c2f97eb
References
- https://huntr.com/bounties/007b84f8-418e-4300-99d0-bf504c2f97eb
- https://access.redhat.com/errata/RHSA-2026:10184
- https://access.redhat.com/errata/RHSA-2026:19712
- https://access.redhat.com/security/cve/CVE-2026-0846
- https://bugzilla.redhat.com/show_bug.cgi?id=2445826
- https://huntr.com/bounties/007b84f8-418e-4300-99d0-bf504c2f97eb
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0846.json