PT-2026-79559 · Pypi · Nltk
CVSS v4.0
8.2
High
| Vector | AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
NLTK versions prior to 3.10.0
Description
A path traversal issue exists in
FramenetCorpusReader and NKJPCorpusReader. This allows attackers to parse XML files located outside the corpus root by providing unsafe selectors or a poisoned index state. The flaw can be exploited through the frame by name(), doc(), lu(), and header() methods using crafted parameters to read arbitrary XML files accessible to the application.Recommendations
Update to version 3.10.0 or later.
Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Nltk