{"id":"CVE-2026-79674","title":"nltk: NLTK: Information disclosure via path traversal in corpus-reader constructors (CVE-2026-79674)","summary":"A flaw was found in NLTK. A path traversal vulnerability in corpus-reader constructors allows a remote attacker to bypass the intended data root sandbox. By supplying arbitrary corpus root paths to LinThesaurusCorpusReader and PanLexLiteCo…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvssSource":"vendor","cwe":["CWE-22","CWE-73"],"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","affected":["exploit_intelligence","lightspeed_core","openshift_lightspeed","ansible_automation_platform 2","openshift_ai_rhoai","openshift_ai 3.5"],"patched":["openshift_ai 3.5"],"published":"2026-08-25","updated":"2026-09-22","sourceUpdated":"2026-09-22T05:58:38+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-79674.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-79674.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-79674"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2523576"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-79674"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79674"},{"url":"https://github.com/nltk/nltk/security/advisories/GHSA-3gq4-3j92-5w49"},{"url":"https://www.vulncheck.com/advisories/nltk-path-traversal-via-corpus-reader-constructors"},{"url":"https://access.redhat.com/errata/RHSA-2026:69539"},{"url":"https://github.com/nltk/nltk/commit/bc007200d123c1a98d74c2eb230f5e06c53886b8"},{"url":"https://github.com/nltk/nltk"},{"url":"https://github.com/nltk/nltk/releases/tag/v3.10.3"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3736.yaml"},{"url":"https://github.com/advisories/GHSA-3gq4-3j92-5w49"}],"tags":["csaf","vex","red-hat","osv","pip","ghsa"],"epss":0.00226,"epssPercentile":0.13516,"aliases":["GHSA-3gq4-3j92-5w49","PYSEC-2026-3736"],"ecosystem":"pip","ingestedAt":"2026-09-02T19:31:24.432Z","slug":"CVE-2026-79674","body":"## Overview\n\nA flaw was found in NLTK. A path traversal vulnerability in corpus-reader constructors allows a remote attacker to bypass the intended data root sandbox. By supplying arbitrary corpus root paths to LinThesaurusCorpusReader and PanLexLiteCorpusReader constructors, an attacker can read files and access SQLite databases outside the security boundary, leading to information disclosure.\n\n## Vendor advisories\n\n- **RHSA-2026:69539** · Red Hat · fixed in: Red Hat OpenShift AI 3.5 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69539)\n- **Red Hat VEX** · Important · affected: Exploit Intelligence, Lightspeed Core, OpenShift Lightspeed, Red Hat Ansible Automation Platform 2, Red Hat OpenShift AI (RHOAI) · no fix planned: Exploit Intelligence, Red Hat Ansible Automation Platform 2, Lightspeed Core, OpenShift Lightspeed, … · updated 2026-09-22 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-79674.json)\n\n**nltk: NLTK: Information disclosure via path traversal in corpus-reader constructors** — rated Important by Red Hat. Released 2026-08-25, updated 2026-09-22.\n\nAffected:\n\n- Exploit Intelligence\n- Lightspeed Core\n- OpenShift Lightspeed\n- Red Hat Ansible Automation Platform 2\n- Red Hat OpenShift AI (RHOAI)\n\nFixed:\n\n- Red Hat OpenShift AI 3.5\n\nNo fix planned:\n\n- Exploit Intelligence\n- Red Hat Ansible Automation Platform 2\n- Lightspeed Core\n- OpenShift Lightspeed\n- Red Hat OpenShift AI (RHOAI)\n\nNot affected:\n\n- Red Hat OpenShift AI 3.5\n- OpenShift Lightspeed\n\n## Remediation\n\nFor Red Hat OpenShift AI 3.5.1 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_ai/ https://access.redhat.com/errata/RHSA-2026:69539\n\nWorkarounds / mitigations:\n\n- Sanitize user input passed to `LinThesaurusCorpusReader` and `PanLexLiteCorpusReader` initialization arguments to enforce strict path validation against expected data root directories before loading corpus files or SQLite databases.\n\n## Package advisory (CVE-2026-79674)\n\nAffected packages:\n\n- `nltk < 3.10.3`\n\nPatched in:\n\n- `nltk 3.10.3`\n\nSource: https://osv.dev/vulnerability/GHSA-3gq4-3j92-5w49","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":203879,"id":"CVE-2026-79674","ts":1789490210628,"field":"cvss","old":null,"new":"7.5"},{"seq":8226,"id":"CVE-2026-79674","ts":1788919993445,"field":"severity","old":"none","new":"high"},{"seq":8035,"id":"CVE-2026-79674","ts":1788919280685,"field":"severity","old":"high","new":"none"},{"seq":7844,"id":"CVE-2026-79674","ts":1788916353968,"field":"severity","old":"none","new":"high"},{"seq":7653,"id":"CVE-2026-79674","ts":1788915297388,"field":"severity","old":"high","new":"none"},{"seq":7462,"id":"CVE-2026-79674","ts":1788912713510,"field":"severity","old":"none","new":"high"},{"seq":7271,"id":"CVE-2026-79674","ts":1788911331319,"field":"severity","old":"high","new":"none"},{"seq":7075,"id":"CVE-2026-79674","ts":1788909076742,"field":"severity","old":"none","new":"high"},{"seq":6887,"id":"CVE-2026-79674","ts":1788907391425,"field":"severity","old":"high","new":"none"},{"seq":6689,"id":"CVE-2026-79674","ts":1788905443073,"field":"severity","old":"none","new":"high"},{"seq":6507,"id":"CVE-2026-79674","ts":1788903459637,"field":"severity","old":"high","new":"none"},{"seq":6297,"id":"CVE-2026-79674","ts":1788901810014,"field":"severity","old":"none","new":"high"},{"seq":6127,"id":"CVE-2026-79674","ts":1788899562087,"field":"severity","old":"high","new":"none"},{"seq":5930,"id":"CVE-2026-79674","ts":1788898179243,"field":"severity","old":"none","new":"high"},{"seq":5819,"id":"CVE-2026-79674","ts":1788895711106,"field":"severity","old":"high","new":"none"},{"seq":5680,"id":"CVE-2026-79674","ts":1788894533648,"field":"severity","old":"none","new":"high"},{"seq":5638,"id":"CVE-2026-79674","ts":1788891871401,"field":"severity","old":"high","new":"none"},{"seq":5571,"id":"CVE-2026-79674","ts":1788888673095,"field":"severity","old":"none","new":"high"},{"seq":5562,"id":"CVE-2026-79674","ts":1788888071565,"field":"severity","old":"high","new":"none"},{"seq":5482,"id":"CVE-2026-79674","ts":1788887288815,"field":"severity","old":"none","new":"high"}]}