CVE-2026-62383

nltk versions before 3.10.2 contain a symlink-based arbitrary file read vulnerability in IPIPANCorpusReader methods that bypass nltk.pathsec validation entirely. Attackers can place a symlink in the corpus root directory and read arbitrary files accessible to the process by calling channels(), domains(), categories(), or fileids() methods with the symlink filename.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/nltk/nltk/security/advisories/GHSA-3hhw-38pf-pxj6	Exploit Mitigation Vendor Advisory
https://www.vulncheck.com/advisories/nltk-ipipancorpusreader-symlink-arbitrary-file-read	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:nltk:nltk:*:*:*:*:*:*:*:*

History

14 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Las versiones de nltk anteriores a la 3.10.2 contienen una vulnerabilidad de lectura arbitraria de archivos basada en symlink en los métodos de IPIPANCorpusReader que omiten por completo la validación de nltk.pathsec. Los atacantes pueden colocar un symlink en el directorio raíz del corpus y leer archivos arbitrarios accesibles para el proceso al llamar a los métodos channels(), domains(), categories() o fileids() con el nombre de archivo del symlink.

Information

Published : 2026-08-22 15:16

Updated : 2026-10-14 13:10

NVD link : CVE-2026-62383

Mitre link : CVE-2026-62383

CVE.ORG link : CVE-2026-62383

JSON object : View

Products Affected

nltk

nltk

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-62383", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-62383", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-26T15:55:30.683365Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.8, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "nltk", "product": "nltk", "versions": [{"status": "affected", "version": "3.10.0", "lessThan": "3.10.2", "versionType": "semver"}, {"status": "unaffected", "version": "3.10.2", "versionType": "semver"}], "packageURL": "pkg:pypi/nltk", "defaultStatus": "unaffected"}]}], "published": "2026-08-22T15:16:17.883", "references": [{"url": "https://github.com/nltk/nltk/security/advisories/GHSA-3hhw-38pf-pxj6", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/nltk-ipipancorpusreader-symlink-arbitrary-file-read", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "nltk versions before 3.10.2 contain a symlink-based arbitrary file read vulnerability in IPIPANCorpusReader methods that bypass nltk.pathsec validation entirely. Attackers can place a symlink in the corpus root directory and read arbitrary files accessible to the process by calling channels(), domains(), categories(), or fileids() methods with the symlink filename."}, {"lang": "es", "value": "Las versiones de nltk anteriores a la 3.10.2 contienen una vulnerabilidad de lectura arbitraria de archivos basada en symlink en los m\u00e9todos de IPIPANCorpusReader que omiten por completo la validaci\u00f3n de nltk.pathsec. Los atacantes pueden colocar un symlink en el directorio ra\u00edz del corpus y leer archivos arbitrarios accesibles para el proceso al llamar a los m\u00e9todos channels(), domains(), categories() o fileids() con el nombre de archivo del symlink."}], "lastModified": "2026-10-14T13:10:00.187", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nltk:nltk:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E99F75B8-E30B-4135-8CA1-A4EDF2737C42", "versionEndExcluding": "3.10.2", "versionStartIncluding": "3.10.0"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}