NLTK 3.9.4 through 3.10.2 contains a path traversal vulnerability in CrubadanCorpusReader. _load_lang_ngrams joins the corpus root with crubadan_code, the column-0 value read from the corpus table.tx
NLTK 3.9.4 through 3.10.2 contains a path traversal vulnerability in CrubadanCorpusReader. _load_lang_ngrams joins the corpus root with crubadan_code, the column-0 value read from the corpus table.txt mapping file, and opens the result with the builtin open() rather than the pathsec-validated opener, so os.path.join discards the root when that value is absolute and the read escapes the corpus directory without the containment check nltk.pathsec applies when ENFORCE is set. An attacker who contr
Affected packages
- nltk
Exploit signal
- Known exploited (CISA KEV)
- No
- EPSS score
- —
- EPSS percentile
- —
EPSS is the probability a CVE is exploited in the wild; percentile is its rank among all CVEs.
Sources
- https://www.cve.org/CVERecord?id=CVE-2026-71514
- https://github.com/nltk/nltk/commit/10d34b3f4fe3fec74b76527a409eb0acbac2e8ab
- https://security-tracker.debian.org/tracker/cve-2026-71514
- https://github.com/cveproject/cvelistv5/tree/main/cves/2026/71xxx/cve-2026-71514.json
- https://github.com/nltk/nltk
- https://github.com/nltk/nltk/blob/v3.10.2/nltk/corpus/reader/crubadan.py#l90-l98
- https://nvd.nist.gov/vuln/detail/cve-2026-71514
- https://www.vulncheck.com/advisories/nltk-through-path-traversal-via-crubadancorpusreader-pathsec-bypass
Structured record: https://ubuntu.com/security/CVE-2026-71514
Recommended response stack
Some links are affiliate links — HackTribune may earn a commission at no extra cost to you.
Get incidents like this as alerts for your stack.
Join the beta