CVE-2026-79674

Katalog CVE

CVSS 8.2 · High EPSS 0,39%

Kerentanan External Control of File Name or Path pada nltk. Skor CVSS 3.1 8.2 (High) menurut vulncheck.com.

Deskripsi (NVD)

NLTK versions before 3.10.3 contain a path sandbox bypass vulnerability in corpus-reader constructors that allows attackers to read files outside the intended data root. Attackers can supply arbitrary corpus root paths to LinThesaurusCorpusReader and PanLexLiteCorpusReader constructors to access filesystem content and SQLite databases outside the pathsec sandbox boundary.

Rincian

Terbit di NVD

25 Agustus 2026

Terakhir diubah

31 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

8.2 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-73: External Control of File Name or Path

EPSS (30 hari)

0,39% peluang dieksploitasi; lebih tinggi dari 30,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nltk/nltk/security/advisories/GHSA-3gq4-3j92-5w49 exploit · advisory vendor
• https://www.vulncheck.com/advisories/nltk-path-traversal-via-corpus-reader-constructors advisory pihak ketiga