CVE-2026-0846: Arbitrary File Read via Absolute Path Input in nltk.util.filestring()
A vulnerability in the filestring() function of the nltk.util module in nltk version 3.9.2 allows arbitrary file read due to improper validation of input paths. The function directly opens files specified by user input without sanitization, enabling attackers to access sensitive system files by providing absolute paths or traversal paths. This vulnerability can be exploited locally or remotely, particularly in scenarios where the function is used in web APIs or other interfaces that accept user-supplied input.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/nltkto a version that resolves this vulnerability.Fixed in 3.9.3-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0846?
CVE-2026-0846 is considered a high severity vulnerability due to its potential for arbitrary file read.
How do I fix CVE-2026-0846?
To fix CVE-2026-0846, ensure that you update the NLTK library to a version that addresses the input validation issue.
What causes CVE-2026-0846?
CVE-2026-0846 is caused by improper validation of input paths in the `filestring()` function allowing for arbitrary file access.
Which versions of NLTK are affected by CVE-2026-0846?
CVE-2026-0846 affects NLTK version 3.9.2 and potentially earlier versions that use the `filestring()` function.
Is there a workaround for CVE-2026-0846?
A workaround for CVE-2026-0846 involves restricting user input to safe file paths prior to calling the `filestring()` function.