CVE-2026-0846highCWE-22CWE-36

CVE-2026-0846: high-severity vulnerability in nltk/nltk

Arbitrary File Read via Absolute Path Input in nltk.util.filestring()

Published · Updated

Follow this CVE+ Monitor nltk/nltk+ Monitor nltk

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 0.6%
A vulnerability in the `filestring()` function of the `nltk.util` module in nltk version 3.9.2 allows arbitrary file read due to improper validation of input paths. The function directly opens files specified by user input without sanitization, enabling attackers to access sensitive system files by providing absolute paths or traversal paths. This vulnerability can be exploited locally or remotely, particularly in scenarios where the function is used in web APIs or other interfaces that accept user-supplied input.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
nltk · nltk/nltk
Related CVEs — nltk/nltk

In the same product, most dangerous first.

CVE-2021-3828HIGHInefficient Regular Expression Complexity in nltk/nltkEPSS 1.6%CVE-2021-3842HIGHInefficient Regular Expression Complexity in nltk/nltkEPSS 1.6%CVE-2025-14009HIGHZip Slip Vulnerability in nltk/nltk Leading to Remote Code ExecutionEPSS 1.0%CVE-2026-0847HIGHPath Traversal in nltk/nltkEPSS 1.0%CVE-2026-0848CRITICALArbitrary Code Execution in NLTK StanfordSegmenter via Untrusted JAR LoadingEPSS 0.8%CVE-2026-12199HIGHUnauthenticated Denial of Service in nltk.app.wordnet_appEPSS 0.3%