CVE-2026-0846

Arbitrary File Read via Absolute Path Input in nltk.util.filestring()

State: Published
Severity: 8.6 High
Published: Mar 9, 2026
Updated: Sep 16, 2026
Reserved: Jan 10, 2026

Description

A vulnerability in the `filestring()` function of the `nltk.util` module in nltk version 3.9.2 allows arbitrary file read due to improper validation of input paths. The function directly opens files specified by user input without sanitization, enabling attackers to access sensitive system files by providing absolute paths or traversal paths. This vulnerability can be exploited locally or remotely, particularly in scenarios where the function is used in web APIs or other interfaces that accept user-supplied input.

Scores

CVSS	Score	Vector	Source
3.0	8.6 High	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L	@huntr_ai
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	redhat-SADP

Weaknesses

CWE-36 Absolute Path Traversal
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Products

Product	Versions
nltk/nltknltk	latest and earlierAffected

References

https://huntr.com/bounties/007b84f8-418e-4300-99d0-bf504c2f97eb
https://access.redhat.com/security/cve/CVE-2026-0846vdb-entry
RHBZ#2445826issue-tracking
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0846.json
https://access.redhat.com/errata/RHSA-2026:10184vendor-advisory
https://access.redhat.com/errata/RHSA-2026:19712vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.