CVE-2026-62384

Katalog CVE

CVSS 7.5 · High EPSS 0,65%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada nltk. Skor CVSS 3.1 7.5 (High) menurut vulncheck.com.

Deskripsi (NVD)

NLTK versions before 3.10.2 contain a symlink-based sandbox bypass in FramenetCorpusReader that allows attackers to read arbitrary XML files outside the corpus root. Attackers can place symlinks with names containing no path separators inside the corpus subdirectory, which pass the path validation guard and are resolved to files outside the intended corpus root when accessed via frame_by_name(), _lu_file(), or doc() methods.

Rincian

Terbit di NVD

22 Agustus 2026

Terakhir diubah

2 September 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,65% peluang dieksploitasi; lebih tinggi dari 49,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nltk/nltk/security/advisories/GHSA-f833-7jw8-xwrv exploit · advisory vendor
• https://www.vulncheck.com/advisories/nltk-framenetcorpusreader-symlink-sandbox-bypass-before advisory pihak ketiga