CVE-2026-62385
NLTK versions before 3.10.0 contain a path traversal vulnerability in FramenetCorpusReader and NKJPCorpusReader that allows attackers to parse XML files outside the corpus root by supplying unsafe selectors or poisoned index state.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.37%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
NLTK versions before 3.10.0 contain a path traversal vulnerability in FramenetCorpusReader and NKJPCorpusReader that allows attackers to parse XML files outside the corpus root by supplying unsafe selectors or poisoned index state. Attackers can exploit frame_by_name, doc, lu, and header methods with crafted parameters to read arbitrary XML files accessible to the application.
- CVSS 4.0
- 8.2 HIGHCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.37% probability · 30th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-73
- Affected
- nltk/nltk
- Source
- disclosure@vulncheck.com
References
- https://github.com/nltk/nltk/security/advisories/GHSA-568f-pv23-39p4Exploit, Vendor Advisory, Mitigation
- https://www.vulncheck.com/advisories/nltk-path-traversal-via-framenet-and-nkjp-readersThird Party Advisory
- https://github.com/nltk/nltk/security/advisories/GHSA-568f-pv23-39p4Exploit, Vendor Advisory, Mitigation
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.