CVE-2026-0846

NameCVE-2026-0846
DescriptionA vulnerability in the `filestring()` function of the `nltk.util` module in nltk version 3.9.2 allows arbitrary file read due to improper validation of input paths. The function directly opens files specified by user input without sanitization, enabling attackers to access sensitive system files by providing absolute paths or traversal paths. This vulnerability can be exploited locally or remotely, particularly in scenarios where the function is used in web APIs or other interfaces that accept user-supplied input.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
nltk (PTS)bullseye3.5-1vulnerable
bookworm3.8-1vulnerable
trixie3.9.1-2vulnerable
forky3.9.2-1vulnerable
sid3.9.3-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
nltksource(unstable)(unfixed)

Notes

https://huntr.com/bounties/007b84f8-418e-4300-99d0-bf504c2f97eb

Search for package or bug name: Reporting problems