CVE-2026-70626
NLTK before 3.9.4 Symlink Escape via CorpusReader
- State
- Published
- Severity
- 8.6 High
- Published
- Aug 22, 2026
- Updated
- Aug 24, 2026
- Reserved
- Aug 4, 2026
Description
NLTK versions before 3.9.4 contain a symlink escape vulnerability in CorpusReader.open() that allows local attackers to read arbitrary files outside the corpus root. The vulnerability exists because path validation is lexical and does not account for symlink resolution, enabling attackers to place symlinks inside the corpus root to access files outside the intended boundary.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.6 High | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 6.2 Medium | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-59 Improper Link Resolution Before File Access ('Link Following')
Affected Products
| Product | Versions |
|---|---|
nltknltk |
|
References
- GitHub Security Advisory (GHSA-r6gq-whwq-mvg9)vendor-advisory
- VulnCheck Advisory: NLTK before 3.9.4 Symlink Escape via CorpusReaderthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.