Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-71514— NLTK 3.9.4 through 3.10.2 Path Traversal via CrubadanCorpusReader pathsec Bypass

Quick assessment

Affected
nltk nltk
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

NLTK 3.9.4 至 3.10.2 版本中，CrubadanCorpusReader 存在路径遍历漏洞。 方法将语料库根目录与从语料库 table.txt 映射文件中读取的 crubadan_code（即第 0 列值）进行拼接，并使用内置的 函数而非经过路径安全验证的操作器来打开生成的文件路径。当该值为绝对路径时， 会丢弃根目录部分，导致读取操作绕过 nltk.pathsec 在 ENFORCE 模式设置下所实施的目录 containment（包含性）检查，从而逃逸出语料库目录。攻击者若能控制一个语料包，即可通

CVSS 2.5 · Low EPSS 0.15% · P5

Possible ATT&CK Techniques 1 AI

T1083 · File and Directory Discovery

Affected Version Matrix 2

VendorProduct Version RangeStatus
nltk nltk 3.9.4< 3.10.3 affected
3.10.3 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-71514

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
NLTK 3.9.4 through 3.10.2 Path Traversal via CrubadanCorpusReader pathsec Bypass
Source: CVE Program / CVE List V5
Vulnerability Description
NLTK 3.9.4 through 3.10.2 contains a path traversal vulnerability in CrubadanCorpusReader. _load_lang_ngrams joins the corpus root with crubadan_code, the column-0 value read from the corpus table.txt mapping file, and opens the result with the builtin open() rather than the pathsec-validated opener, so os.path.join discards the root when that value is absolute and the read escapes the corpus directory without the containment check nltk.pathsec applies when ENFORCE is set. An attacker who controls a corpus package can disclose file contents outside the corpus root through lang_freq, limited to paths ending in -3grams.txt whose contents parse as token count lines.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
nltk nltk 3.9.4 ~ 3.10.3 -

II. Public POCs for CVE-2026-71514

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-71514

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-71514 (1)

Other References for CVE-2026-71514 (1)

Same Patch Batch · nltk · 2026-08-22 · 12 CVEs total

CVE-2026-71513 8.8 HIGH NLTK 3.10.0 through 3.10.2 Remote Code Execution via AllowlistUnpickler Dotted-Name Bypass
CVE-2026-62388 7.5 HIGH NLTK before 3.10.0 Insecure Default Configuration pathsec
CVE-2026-62384 7.5 HIGH NLTK FramenetCorpusReader Symlink Sandbox Bypass before 3.10.2
CVE-2026-66393 7.5 HIGH NLTK before 3.9.4 Denial of Service via JSONTaggedDecoder
CVE-2026-63312 7.5 HIGH NLTK StreamBackedCorpusView Bypasses pathsec.ENFORCE Arbitrary File Read
CVE-2026-63310 7.1 HIGH NLTK before 3.9.3 Missing Post-Download Integrity Verification
CVE-2026-65915 6.5 MEDIUM NLTK before 3.10.0 Arbitrary File Read via FileSystemPathPointer
CVE-2026-70626 6.2 MEDIUM NLTK before 3.9.4 Symlink Escape via CorpusReader
CVE-2026-62385 5.9 MEDIUM NLTK 3.9.4 Path Traversal via FrameNet and NKJP Readers
CVE-2026-62383 5.5 MEDIUM nltk IPIPANCorpusReader Symlink Arbitrary File Read
CVE-2026-63311 5.3 MEDIUM NLTK before 3.10.0 SSRF via DNS Resolution Failure

IV. Related Vulnerabilities

Same product: nltk
Same vendor: nltk
Same weakness: CWE-22

V. Comments for CVE-2026-71514

No comments yet

Leave a comment