CVE-2026-70626

Katalog CVE

CVSS 6.2 · Medium EPSS 0,20%

Kerentanan Improper Link Resolution Before File Access ('Link Following') pada nltk. Skor CVSS 3.1 6.2 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

NLTK versions before 3.9.4 contain a symlink escape vulnerability in CorpusReader.open() that allows local attackers to read arbitrary files outside the corpus root. The vulnerability exists because path validation is lexical and does not account for symlink resolution, enabling attackers to place symlinks inside the corpus root to access files outside the intended boundary.

Rincian

Terbit di NVD

22 Agustus 2026

Terakhir diubah

31 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

6.2 (Medium), sumber vulncheck.com
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-59: Improper Link Resolution Before File Access ('Link Following')

EPSS (30 hari)

0,20% peluang dieksploitasi; lebih tinggi dari 9,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nltk/nltk/security/advisories/GHSA-r6gq-whwq-mvg9 exploit · advisory vendor
• https://www.vulncheck.com/advisories/nltk-before-symlink-escape-via-corpusreader advisory vendor