p PatchFirst

CVE-2026-70626

CVE-2026-70626 · NLTK before 3.9.4 Symlink Escape via CorpusReader

This page contains facts from public vulnerability sources. Check the original advisory before updating.

NLTK versions before 3.9.4 contain a symlink escape vulnerability in CorpusReader.open() that allows local attackers to read arbitrary files outside the corpus root. The vulnerability exists because path validation is lexical and does not account for symlink resolution, enabling attackers to place symlinks inside the corpus root to access files outside the intended boundary.

CVSS 8.6 · High · EPSS 0.2% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • nltk

    Versions
    • ≥ 0, < 3.9.4: Affected (semver)
    • 3.9.4: Not affected (semver)

    Update to 3.9.4

  • nltk Debian:12

    Versions
    • 3.10.0-1
    • 3.10.1-1
    • 3.10.3-1
    • 3.8-1
    • 3.8.1-1
    • 3.9.1-1
    • 3.9.1-2
    • 3.9.2-1
    • 3.9.3-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nltk Debian:13

    Versions
    • 3.10.0-1
    • 3.10.1-1
    • 3.10.3-1
    • 3.9.1-2
    • 3.9.2-1
    • 3.9.3-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nltk Debian:14

    Versions
    • 3.9.1-2
    • 3.9.2-1
    • 3.9.3-1
    Affected ranges
    • ECOSYSTEM: < 3.10.0-1

    Update to 3.10.0-1

  • nltk PyPI

    Versions
    • 0.8
    • 0.9
    • 0.9.3
    • 0.9.4
    • 0.9.5
    • 0.9.6
    • 0.9.7
    • 0.9.8
    • 0.9.9
    • 2.0.1
    • 2.0.1rc1
    • 2.0.1rc2-git
    • 2.0.1rc3
    • 2.0.1rc4
    • 2.0.2
    • 2.0.3
    • 2.0.4
    • 2.0.5
    • 2.0b4
    • 2.0b5
    • 2.0b6
    • 2.0b7
    • 2.0b8
    • 2.0b9
    • 3.0.0
    • 3.0.0b1
    • 3.0.0b2
    • 3.0.1
    • 3.0.2
    • 3.0.3
    • 3.0.4
    • 3.0.5
    • 3.1
    • 3.2
    • 3.2.1
    • 3.2.2
    • 3.2.3
    • 3.2.4
    • 3.2.5
    • 3.3
    • 3.4
    • 3.4.1
    • 3.4.2
    • 3.4.3
    • 3.4.4
    • 3.4.5
    • 3.5
    • 3.5b1
    • 3.6
    • 3.6.1
    • 3.6.2
    • 3.6.3
    • 3.6.4
    • 3.6.5
    • 3.6.6
    • 3.6.7
    • 3.7
    • 3.8
    • 3.8.1
    • 3.9
    • 3.9.1
    • 3.9.2
    • 3.9.3
    • 3.9b1
    Affected ranges
    • ECOSYSTEM: < 3.9.4

    Update to 3.9.4

  • nltk Ubuntu:Pro:14.04:LTS

    Versions
    • 2.0~b9-0ubuntu4
    • 2.0~b9-0ubuntu4.1~esm2
    • 2.0~b9-0ubuntu4.1~esm4
    • 2.0~b9-0ubuntu4.1~esm5
    • 2.0~b9-0ubuntu4.1~esm6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nltk Ubuntu:Pro:16.04:LTS

    Versions
    • 3.0.4-1
    • 3.0.5-1
    • 3.1-1
    • 3.1-1ubuntu0.1
    • 3.1-1ubuntu0.1+esm1
    • 3.1-1ubuntu0.1+esm2
    • 3.1-1ubuntu0.1+esm3
    • 3.1-1ubuntu0.1+esm4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nltk Ubuntu:Pro:18.04:LTS

    Versions
    • 3.2.4-1
    • 3.2.5-1
    • 3.2.5-1ubuntu0.1
    • 3.2.5-1ubuntu0.1+esm1
    • 3.2.5-1ubuntu0.1+esm2
    • 3.2.5-1ubuntu0.1+esm3
    • 3.2.5-1ubuntu0.1+esm4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nltk Ubuntu:Pro:20.04:LTS

    Versions
    • 3.4.5-1
    • 3.4.5-2
    • 3.4.5-2ubuntu0.1~esm1
    • 3.4.5-2ubuntu0.1~esm2
    • 3.4.5-2ubuntu0.1~esm3
    • 3.4.5-2ubuntu0.1~esm4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nltk Ubuntu:Pro:22.04:LTS

    Versions
    • 3.5-1
    • 3.6.5-1
    • 3.6.7-1
    • 3.7-1
    • 3.7-1ubuntu0.1~esm1
    • 3.7-1ubuntu0.1~esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nltk Ubuntu:Pro:24.04:LTS

    Versions
    • 3.8.1-1
    • 3.8.1-1ubuntu0.1~esm1
    • 3.8.1-1ubuntu0.1~esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nltk Ubuntu:26.10

    Versions
    • 3.9.2-1
    • 3.9.3-1
    • 3.10.0-1
    • 3.10.1-1
    • 3.10.3-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nltk Ubuntu:Pro:26.04:LTS

    Versions
    • 3.9.1-2
    • 3.9.1-2build1
    • 3.9.2-1
    • 3.9.2-1ubuntu0.1~esm1
    • 3.9.2-1ubuntu0.1~esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →