CVE-2026-63312CWE-22path-traversal

CVE-2026-63312

High · published August 22, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
50.6
In the wild
Unconfirmed
What it is

NLTK before 3.10.0 contains an arbitrary local file read vulnerability in StreamBackedCorpusView that bypasses pathsec.ENFORCE by calling builtins.open() directly instead of pathsec.open(). Attackers who control the fileid argument can read arbitrary local files regardless of the ENFORCE setting, including sensitive system files and application credentials.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00651 · 50.6th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-08-22T19:16Z
Affected products (1)
ProductVersionsFixed in
nltk/nltk< 3.10.03.10.0
References (3)
https://github.com/nltk/nltk/security/advisories/GHSA-x5ph-mj9p-rfr8 · [email protected]https://www.vulncheck.com/advisories/nltk-streambackedcorpusview-bypasses-pathsec-enforce-arbitrary-file-read · [email protected]https://github.com/nltk/nltk/security/advisories/GHSA-x5ph-mj9p-rfr8 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 22 AUG 14:12Z
    NLTK StreamBackedCorpusView Bypasses pathsec.ENFORCE Arbitrary File Read
    cvelistv5