CVE-2026-62383

Katalog CVE

CVSS 5.5 · Medium EPSS 0,18%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada nltk. Skor CVSS 3.1 5.5 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

nltk versions before 3.10.2 contain a symlink-based arbitrary file read vulnerability in IPIPANCorpusReader methods that bypass nltk.pathsec validation entirely. Attackers can place a symlink in the corpus root directory and read arbitrary files accessible to the process by calling channels(), domains(), categories(), or fileids() methods with the symlink filename.

Rincian

Terbit di NVD

22 Agustus 2026

Terakhir diubah

27 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

5.5 (Medium), sumber vulncheck.com
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,18% peluang dieksploitasi; lebih tinggi dari 7,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nltk/nltk/security/advisories/GHSA-3hhw-38pf-pxj6 exploit · mitigasi · advisory vendor
• https://www.vulncheck.com/advisories/nltk-ipipancorpusreader-symlink-arbitrary-file-read advisory pihak ketiga