CVE-2026-65915

NLTK versions before 3.10.0 contain a logic bug in FileSystemPathPointer.open() where the sandbox validation check compares a normalized path against itself, making the security check permanently inert. Attackers can pass file:// URLs to nltk.data.load() to read arbitrary files accessible to the process user, including credentials and configuration files.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/nltk/nltk/security/advisories/GHSA-72r2-7mfr-5xr9	Exploit Vendor Advisory
https://www.vulncheck.com/advisories/nltk-before-arbitrary-file-read-via-filesystempathpointer	Third Party Advisory
https://github.com/nltk/nltk/security/advisories/GHSA-72r2-7mfr-5xr9	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:nltk:nltk:*:*:*:*:*:*:*:*

History

14 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Las versiones de NLTK anteriores a la 3.10.0 contienen un error lógico en FileSystemPathPointer.open() donde la comprobación de validación del sandbox compara una ruta normalizada consigo misma, haciendo que la comprobación de seguridad sea permanentemente inerte. Los atacantes pueden pasar URL de tipo file: // a nltk.data.load() para leer archivos arbitrarios accesibles para el usuario del proceso, incluyendo credenciales y archivos de configuración.

Information

Published : 2026-08-22 15:16

Updated : 2026-10-14 13:10

NVD link : CVE-2026-65915

Mitre link : CVE-2026-65915

CVE.ORG link : CVE-2026-65915

JSON object : View

Products Affected

nltk

nltk

CWE

CWE-284

Improper Access Control

{"id": "CVE-2026-65915", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-65915", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-24T19:20:34.826563Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "nltk", "product": "nltk", "versions": [{"status": "affected", "version": "0", "lessThan": "3.10.0", "versionType": "semver"}, {"status": "unaffected", "version": "3.10.0", "versionType": "semver"}], "packageURL": "pkg:pypi/nltk", "defaultStatus": "unaffected"}]}], "published": "2026-08-22T15:16:19.500", "references": [{"url": "https://github.com/nltk/nltk/security/advisories/GHSA-72r2-7mfr-5xr9", "tags": ["Exploit", "Vendor Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/nltk-before-arbitrary-file-read-via-filesystempathpointer", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/nltk/nltk/security/advisories/GHSA-72r2-7mfr-5xr9", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "NLTK versions before 3.10.0 contain a logic bug in FileSystemPathPointer.open() where the sandbox validation check compares a normalized path against itself, making the security check permanently inert. Attackers can pass file:// URLs to nltk.data.load() to read arbitrary files accessible to the process user, including credentials and configuration files."}, {"lang": "es", "value": "Las versiones de NLTK anteriores a la 3.10.0 contienen un error l\u00f3gico en FileSystemPathPointer.open() donde la comprobaci\u00f3n de validaci\u00f3n del sandbox compara una ruta normalizada consigo misma, haciendo que la comprobaci\u00f3n de seguridad sea permanentemente inerte. Los atacantes pueden pasar URL de tipo file: // a nltk.data.load() para leer archivos arbitrarios accesibles para el usuario del proceso, incluyendo credenciales y archivos de configuraci\u00f3n."}], "lastModified": "2026-10-14T13:10:00.187", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nltk:nltk:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "653A48E1-BCC5-4342-B5DF-E8D71A83BCB9", "versionEndExcluding": "3.10.0"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}