CVE-2026-0847: A vulnerability in NLTK versions up to and including 3.9.2 allows arbitrary file read via path traversal in multiple Cor
Summary
NLTK (a natural language processing library) versions up to 3.9.2 have a vulnerability called path traversal (where an attacker manipulates file paths to access files outside intended directories) in its CorpusReader classes. This allows attackers to read sensitive files on a server when the library processes user-provided file paths, potentially exposing private keys and tokens.
Vulnerability Details
EPSS: 0.2%
Classification
Affected Vendors
Related Issues
CVE-2024-37052: Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling
CVE-2025-45150: Insecure permissions in LangChain-ChatGLM-Webui commit ef829 allows attackers to arbitrarily view and download sensitive
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-0847
First tracked: March 4, 2026 at 03:07 PM
Classified by LLM (prompt v3) · confidence: 92%