CVE-2026-62385

Katalog CVE

CVSS 7.5 · High EPSS 0,42%

Kerentanan External Control of File Name or Path pada nltk. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

NLTK versions before 3.10.0 contain a path traversal vulnerability in FramenetCorpusReader and NKJPCorpusReader that allows attackers to parse XML files outside the corpus root by supplying unsafe selectors or poisoned index state. Attackers can exploit frame_by_name, doc, lu, and header methods with crafted parameters to read arbitrary XML files accessible to the application.

Rincian

Terbit di NVD

22 Agustus 2026

Terakhir diubah

31 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-73: External Control of File Name or Path

EPSS (30 hari)

0,42% peluang dieksploitasi; lebih tinggi dari 34,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nltk/nltk/security/advisories/GHSA-568f-pv23-39p4 exploit · advisory vendor · mitigasi
• https://www.vulncheck.com/advisories/nltk-path-traversal-via-framenet-and-nkjp-readers advisory pihak ketiga