VULNERABILITY INTELLIGENCE

CVE-2026-70626

CVSS score6.2 MEDIUM
EPSS probability0.20%
CISA KEVNot currently listed
Published2026-08-22
Last modified2026-10-14
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

NLTK versions before 3.9.4 contain a symlink escape vulnerability in CorpusReader.open() that allows local attackers to read arbitrary files outside the corpus root. The vulnerability exists because path validation is lexical and does not account for symlink resolution, enabling attackers to place symlinks inside the corpus root to access files outside the intended boundary.

Weakness classification

  • disclosure@vulncheck.com: CWE-59

Primary references