HIGH 8.6 NVD
CVE-2026-70626
NLTK versions before 3.9.4 contain a symlink escape vulnerability in CorpusReader.open() that allows local attackers to read arbitrary files outside the corpus
NLTK versions before 3.9.4 contain a symlink escape vulnerability in CorpusReader.open() that allows local attackers to read arbitrary files outside the corpus root. The vulnerability exists because path validation is lexical and does not account for symlink resolution, enabling attackers to place symlinks inside the corpus root to access files outside the intended boundary.
References
- https://github.com/nltk/nltk/security/advisories/GHSA-r6gq-whwq-mvg9
- https://www.vulncheck.com/advisories/nltk-before-symlink-escape-via-corpusreader
This high severity vulnerability with a CVSS score of 8.6 was published on 2026-08-22 via NVD.
vulnfeed aggregates 11022 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.