CVE-2026-0846: Arbitrary File Read via Absolute Path Input in nltk.util.filestring()

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-03-09 · updated 2026-07-15
Weakness: CWE-36

Description

A vulnerability in the `filestring()` function of the `nltk.util` module in nltk version 3.9.2 allows arbitrary file read due to improper validation of input paths. The function directly opens files specified by user input without sanitization, enabling attackers to access sensitive system files by providing absolute paths or traversal paths. This vulnerability can be exploited locally or remotely, particularly in scenarios where the function is used in web APIs or other interfaces that accept user-supplied input.

Affected products

nltk: 3.9.2

References

https://huntr.com/bounties/007b84f8-418e-4300-99d0-bf504c2f97eb
https://access.redhat.com/errata/RHSA-2026:10184
https://access.redhat.com/errata/RHSA-2026:19712
https://access.redhat.com/security/cve/CVE-2026-0846
https://bugzilla.redhat.com/show_bug.cgi?id=2445826
https://huntr.com/bounties/007b84f8-418e-4300-99d0-bf504c2f97eb
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0846.json

Get alerted when CVE-2026-0846 or the next vulnerability affects your stack