What’s Vulnerable › Vulnerabilities

CVE-2026-62385: NLTK 3.9.4 Path Traversal via FrameNet and NKJP Readers

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-08-22 · updated 2026-10-14
• Weakness: CWE-73

Description

NLTK versions before 3.10.0 contain a path traversal vulnerability in FramenetCorpusReader and NKJPCorpusReader that allows attackers to parse XML files outside the corpus root by supplying unsafe selectors or poisoned index state. Attackers can exploit frame_by_name, doc, lu, and header methods with crafted parameters to read arbitrary XML files accessible to the application.

Affected products

• nltk: before 3.10.0 — fixed in 3.10.0

How to fix

Upgrade to a fixed version: nltk 3.10.0. Check the vendor advisory for mitigations.

References

• https://github.com/nltk/nltk/security/advisories/GHSA-568f-pv23-39p4
• https://www.vulncheck.com/advisories/nltk-path-traversal-via-framenet-and-nkjp-readers
• https://github.com/nltk/nltk/security/advisories/GHSA-568f-pv23-39p4

Get alerted when CVE-2026-62385 or the next vulnerability affects your stack