CVE catalog
CVE-2026-0846
A vulnerability in the `filestring()` function of the `nltk.util` module in nltk version 3.9.2 allows arbitrary file read due to improper validation of input paths. The function directly opens files s
- Severity
- High · CVSS 8.6
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.54% · Oct 25, 2026
A vulnerability in the `filestring()` function of the `nltk.util` module in nltk version 3.9.2 allows arbitrary file read due to improper validation of input paths. The function directly opens files specified by user input without sanitization, enabling attackers to access sensitive system files by providing absolute paths or traversal paths. This vulnerability can be exploited locally or remotely, particularly in scenarios where the function is used in web APIs or other interfaces that accept user-supplied input.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | nltk | sid | 3.10.3-1 | fixed |
| Debian | nltk | forky | 3.10.3-1 | fixed |
| Debian | nltk | trixie | 3.9.1-2 | vulnerable |
| Debian | nltk | bookworm | 3.8-1 | vulnerable |
| Cpe | nltk | Not reported | Not reported | vulnerable |
| Cpe | nltk | Not reported | 3.8.1-1ubuntu0.1~esm2 | fixed |
| Cpe | python3-nltk | Not reported | 3.8.1-1ubuntu0.1~esm2 | fixed |
| Ubuntu | nltk | pro | 3.9.1-2 | vulnerable |
| Ubuntu | nltk | pro | 3.9.1-2build1 | vulnerable |
| Ubuntu | nltk | pro | 3.9.2-1 | vulnerable |
| Ubuntu | nltk | pro | 3.9.2-1ubuntu0.1~esm1 | vulnerable |
| Ubuntu | nltk | pro | 3.9.2-1ubuntu0.1~esm2 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | nltk | source | sid | 3.9.3-1 | not yet assigned | Not reported | Not reported |
| Debian | nltk | source | forky | 3.9.3-1 | not yet assigned | Not reported | Not reported |
| Debian | nltk | source | trixie | (unfixed) | not yet assigned | Not reported | Not reported |
| Debian | nltk | source | bookworm | (unfixed) | not yet assigned | Not reported | Not reported |
| Cpe | nltk | cpe | Not reported | 3.8.1-1ubuntu0.1~esm2 | Not reported | Not reported | Not reported |
| Cpe | python3-nltk | cpe | Not reported | 3.8.1-1ubuntu0.1~esm2 | Not reported | Not reported | Not reported |
| Ubuntu | nltk | deb | pro | 3.9.2-1ubuntu0.1~esm2 | Not reported | USN-8302-1 | Not reported |
Notes
[trixie] nltk: Minor issue [bookworm] nltk: Minor issue
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [python3-nltk]Affected
Source package: [nltk]
Details (2)
3.8-1· all · bookwormAffected
nvd · nltk · debian · bookworm; nvd · nltk · debian · 12
3.8-1· all · bookwormAffected
nvd · nltk · debian · bookworm; nvd · nltk · debian · 12
[Debian 13 (Trixie)]
- [python3-nltk]Affected
Source package: [nltk]
Details (2)
3.9.1-2· all · trixieAffected
nvd · nltk · debian · 13
3.9.1-2· all · trixieAffected
nvd · nltk · debian · 13
Observed:
References
- [https://nvd.nist.gov/vuln/detail/CVE-2026-0846]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-0846]
- [https://osv.dev/vulnerability/USN-8302-1]
- [https://security-tracker.debian.org/tracker/CVE-2026-0846]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0846.json]
- [https://ubuntu.com/security/notices/USN-8302-1]
[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [Ubuntu Security Notices (USN)]