PT-2026-79563 · Pypi · Nltk
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
NLTK versions prior to 3.10.0
Description
An arbitrary local file read issue exists in
StreamBackedCorpusView where the system bypasses pathsec.ENFORCE by calling builtins.open() directly instead of pathsec.open(). Attackers who control the fileid argument can read arbitrary local files, including sensitive system files and application credentials, regardless of the ENFORCE setting.Recommendations
Update NLTK to version 3.10.0 or later.
Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Nltk