CVE-2026-62385— NLTK 3.9.4 Path Traversal via FrameNet and NKJP Readers
Possible ATT&CK Techniques 1AI
T1555 · Credentials from Password StoresGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-62385
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
NLTK 3.9.4 Path Traversal via FrameNet and NKJP Readers
Source: CVE Program / CVE List V5
Vulnerability Description
NLTK versions before 3.10.0 contain a path traversal vulnerability in FramenetCorpusReader and NKJPCorpusReader that allows attackers to parse XML files outside the corpus root by supplying unsafe selectors or poisoned index state. Attackers can exploit frame_by_name, doc, lu, and header methods with crafted parameters to read arbitrary XML files accessible to the application.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
文件名或路径的外部可控制
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-62385
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-62385
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-62385 (2)
Same Patch Batch · nltk · 2026-08-22 · 12 CVEs total
| CVE-2026-71513 | 8.8 HIGH | NLTK 3.10.0 through 3.10.2 Remote Code Execution via AllowlistUnpickler Dotted-Name Bypass |
| CVE-2026-62388 | 7.5 HIGH | NLTK before 3.10.0 Insecure Default Configuration pathsec |
| CVE-2026-62384 | 7.5 HIGH | NLTK FramenetCorpusReader Symlink Sandbox Bypass before 3.10.2 |
| CVE-2026-66393 | 7.5 HIGH | NLTK before 3.9.4 Denial of Service via JSONTaggedDecoder |
| CVE-2026-63312 | 7.5 HIGH | NLTK StreamBackedCorpusView Bypasses pathsec.ENFORCE Arbitrary File Read |
| CVE-2026-63310 | 7.1 HIGH | NLTK before 3.9.3 Missing Post-Download Integrity Verification |
| CVE-2026-65915 | 6.5 MEDIUM | NLTK before 3.10.0 Arbitrary File Read via FileSystemPathPointer |
| CVE-2026-70626 | 6.2 MEDIUM | NLTK before 3.9.4 Symlink Escape via CorpusReader |
| CVE-2026-62383 | 5.5 MEDIUM | nltk IPIPANCorpusReader Symlink Arbitrary File Read |
| CVE-2026-63311 | 5.3 MEDIUM | NLTK before 3.10.0 SSRF via DNS Resolution Failure |
| CVE-2026-71514 | 2.5 LOW | NLTK 3.9.4 through 3.10.2 Path Traversal via CrubadanCorpusReader pathsec Bypass |
IV. Related Vulnerabilities
Same product: nltk
- CVE-2026-70626
NLTK before 3.9.4 Symlink Escape via CorpusReader - CVE-2026-66393
NLTK before 3.9.4 Denial of Service via JSONTaggedDecoder - CVE-2026-65915
NLTK before 3.10.0 Arbitrary File Read via FileSystemPathPoi - CVE-2026-63312
NLTK StreamBackedCorpusView Bypasses pathsec.ENFORCE Arbitra - CVE-2026-63311
NLTK before 3.10.0 SSRF via DNS Resolution Failure
Same vendor: nltk
- CVE-2026-70626
NLTK before 3.9.4 Symlink Escape via CorpusReader - CVE-2026-66393
NLTK before 3.9.4 Denial of Service via JSONTaggedDecoder - CVE-2026-63312
NLTK StreamBackedCorpusView Bypasses pathsec.ENFORCE Arbitra - CVE-2026-65915
NLTK before 3.10.0 Arbitrary File Read via FileSystemPathPoi - CVE-2026-63311
NLTK before 3.10.0 SSRF via DNS Resolution Failure
Same weakness: CWE-73
- CVE-2026-49360
Recce server has unauthenticated SQL execution that allows l - CVE-2026-54134
OctoPrint: File exfiltration possible via query parameters o - CVE-2026-63343
Arbitrary File Read/Write: metadata.yaml symlink in image al - CVE-2026-48753
Incus has an arbitrary file write via path traversal in S3 m - CVE-2026-48752
Incus has arbitrary file read+write on host via templates/ s
V. Comments for CVE-2026-62385
No comments yet