Skip to main content

NLTK EUVDEUVD-2026-64333

| CVE-2026-63312 HIGH
Path Traversal (CWE-22)
2026-08-22 VulnCheck GHSA-8w48-h75v-cxpv
Path Traversal Nltk
8.7
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Network vector for web-facing NLTK deployments; no privileges or user interaction required once fileid is attacker-influenced; impact is confidentiality-only from the arbitrary file read.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Analysis Generated
Aug 22, 2026 - 15:05 vuln.today
Patch available
Aug 22, 2026 - 15:01 EUVD
CVE Published
Aug 22, 2026 - 14:12 cve.org
HIGH 8.7

DescriptionCVE.org

NLTK before 3.10.0 contains an arbitrary local file read vulnerability in StreamBackedCorpusView that bypasses pathsec.ENFORCE by calling builtins.open() directly instead of pathsec.open(). Attackers who control the fileid argument can read arbitrary local files regardless of the ENFORCE setting, including sensitive system files and application credentials.

AnalysisAI

StreamBackedCorpusView in NLTK before 3.10.0 allows arbitrary local file reads by calling Python's builtins.open() directly, fully bypassing the pathsec.ENFORCE security boundary regardless of how that control is configured. Web applications and services built on NLTK that pass externally controlled values to the fileid argument are at risk of having sensitive system files, credentials, and configuration data read by remote attackers. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify web endpoint accepting user-supplied fileid for NLTK corpus loading
Delivery
Submit crafted file path (e.g., /etc/passwd or app secrets file) as fileid
Exploit
StreamBackedCorpusView invokes builtins.open() directly
Execution
pathsec.ENFORCE boundary bypassed silently
Persist
Arbitrary local file contents returned in application response
Impact
Exfiltrate credentials or sensitive configuration data
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the consuming application passes attacker-controlled or externally influenced values to the fileid argument of StreamBackedCorpusView without application-layer path validation or allowlisting. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 base score of 8.7 with AV:N/AC:L/AT:N/PR:N/UI:N/VC:H reflects the high confidentiality impact assuming a network-accessible NLTK deployment where user input reaches the fileid argument - the official scoring treats no specific attack requirement as necessary. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker targeting a web service that accepts a corpus file identifier from user input and passes it to StreamBackedCorpusView submits a path such as /etc/passwd or an application secrets file. Because StreamBackedCorpusView calls builtins.open() directly, pathsec.ENFORCE is silently bypassed and the file contents are returned. …
Remediation Upgrade NLTK to version 3.10.0 or later, which corrects StreamBackedCorpusView to route file access through pathsec.open() instead of builtins.open(). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: identify all applications and infrastructure components using NLTK and document their current versions and deployment environments. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Nltk

View all
CVE-2025-14009 HIGH POC
8.8 Feb 18

Arbitrary code execution in the NLTK (Natural Language Toolkit) Python library affects all versions through its data dow
CVE-2021-43854 HIGH POC
7.5 Dec 23

NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research a
CVE-2021-3828 HIGH POC
7.5 Sep 27

nltk is vulnerable to Inefficient Regular Expression Complexity. Rated high severity (CVSS 7.5), this vulnerability is r
CVE-2019-14751 HIGH POC
7.5 Aug 22

NLTK Downloader before 3.4.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a .
CVE-2026-78683 CRITICAL
9.4 Aug 25

Arbitrary code execution in NLTK (Natural Language Toolkit) through 3.9.4 allows attackers to run Python code when a vic
CVE-2026-79675 CRITICAL
9.3 Aug 25

Argument injection in the Natural Language Toolkit (NLTK) Python library before 3.10.3 allows attackers who control the

CVE-2026-63310 CRITICAL
9.3 Aug 22

Arbitrary code injection in the Natural Language Toolkit (NLTK) before 3.9.3 stems from the downloader module extracting
CVE-2026-79657 CRITICAL
9.3 Aug 25

Arbitrary code execution in the Natural Language Toolkit (NLTK) before 3.10.3 allows attackers to bypass the library's p
CVE-2026-71513 HIGH
8.7 Aug 22

Remote code execution in NLTK's TransitionParser component allows arbitrary OS command execution when a victim loads a c
CVE-2026-62384 HIGH
8.7 Aug 22

Symlink-based path traversal in NLTK's FramenetCorpusReader before version 3.10.2 permits attackers with write access to
CVE-2026-79674 HIGH
8.8 Aug 25

Path traversal in NLTK before 3.10.3 exposes arbitrary filesystem content and SQLite databases by bypassing the library'
CVE-2026-66393 HIGH
8.7 Aug 22

Unbounded recursion in NLTK's JSONTaggedDecoder.decode_obj() (nltk/jsontags.py) allows unauthenticated remote attackers

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0
CVE-2022-37042 CRITICAL POC
9.8

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8
CVE-2022-30333 HIGH POC
7.5

Share

EUVD-2026-64333 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy