p PatchFirst

CVE-2026-62384

CVE-2026-62384 · NLTK FramenetCorpusReader Symlink Sandbox Bypass before 3.10.2

This page contains facts from public vulnerability sources. Check the original advisory before updating.

NLTK versions before 3.10.2 contain a symlink-based sandbox bypass in FramenetCorpusReader that allows attackers to read arbitrary XML files outside the corpus root. Attackers can place symlinks with names containing no path separators inside the corpus subdirectory, which pass the path validation guard and are resolved to files outside the intended corpus root when accessed via frame_by_name(), _lu_file(), or doc() methods.

CVSS 8.7 · High · EPSS 0.7% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • nltk

    Versions
    • ≥ 3.10.0, < 3.10.2: Affected (semver)
    • 3.10.2: Not affected (semver)

    Update to 3.10.2

  • nltk Debian:12

    Versions
    • 3.10.0-1
    • 3.10.1-1
    • 3.10.3-1
    • 3.8-1
    • 3.8.1-1
    • 3.9.1-1
    • 3.9.1-2
    • 3.9.2-1
    • 3.9.3-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nltk Debian:13

    Versions
    • 3.10.0-1
    • 3.10.1-1
    • 3.10.3-1
    • 3.9.1-2
    • 3.9.2-1
    • 3.9.3-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nltk Debian:14

    Versions
    • 3.10.0-1
    • 3.10.1-1
    • 3.9.1-2
    • 3.9.2-1
    • 3.9.3-1
    Affected ranges
    • ECOSYSTEM: < 3.10.3-1

    Update to 3.10.3-1

  • nltk PyPI

    Versions
    • 3.10.0
    • 3.10.1
    Affected ranges
    • ECOSYSTEM: ≥ 3.10.0, < 3.10.2

    Update to 3.10.2

  • nltk Ubuntu:Pro:14.04:LTS

    Versions
    • 2.0~b9-0ubuntu4
    • 2.0~b9-0ubuntu4.1~esm2
    • 2.0~b9-0ubuntu4.1~esm4
    • 2.0~b9-0ubuntu4.1~esm5
    • 2.0~b9-0ubuntu4.1~esm6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nltk Ubuntu:Pro:16.04:LTS

    Versions
    • 3.0.4-1
    • 3.0.5-1
    • 3.1-1
    • 3.1-1ubuntu0.1
    • 3.1-1ubuntu0.1+esm1
    • 3.1-1ubuntu0.1+esm2
    • 3.1-1ubuntu0.1+esm3
    • 3.1-1ubuntu0.1+esm4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nltk Ubuntu:Pro:18.04:LTS

    Versions
    • 3.2.4-1
    • 3.2.5-1
    • 3.2.5-1ubuntu0.1
    • 3.2.5-1ubuntu0.1+esm1
    • 3.2.5-1ubuntu0.1+esm2
    • 3.2.5-1ubuntu0.1+esm3
    • 3.2.5-1ubuntu0.1+esm4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nltk Ubuntu:Pro:20.04:LTS

    Versions
    • 3.4.5-1
    • 3.4.5-2
    • 3.4.5-2ubuntu0.1~esm1
    • 3.4.5-2ubuntu0.1~esm2
    • 3.4.5-2ubuntu0.1~esm3
    • 3.4.5-2ubuntu0.1~esm4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nltk Ubuntu:Pro:22.04:LTS

    Versions
    • 3.5-1
    • 3.6.5-1
    • 3.6.7-1
    • 3.7-1
    • 3.7-1ubuntu0.1~esm1
    • 3.7-1ubuntu0.1~esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nltk Ubuntu:Pro:24.04:LTS

    Versions
    • 3.8.1-1
    • 3.8.1-1ubuntu0.1~esm1
    • 3.8.1-1ubuntu0.1~esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nltk Ubuntu:26.10

    Versions
    • 3.9.2-1
    • 3.9.3-1
    • 3.10.0-1
    • 3.10.1-1
    • 3.10.3-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nltk Ubuntu:Pro:26.04:LTS

    Versions
    • 3.9.1-2
    • 3.9.1-2build1
    • 3.9.2-1
    • 3.9.2-1ubuntu0.1~esm1
    • 3.9.2-1ubuntu0.1~esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →