CVE-2026-0846: nltk 3.9.2 filestring() Arbitrary File Read (CWE-22)
CVE-2026-0846 Published on March 9, 2026

Arbitrary File Read via Absolute Path Input in nltk.util.filestring()
A vulnerability in the `filestring()` function of the `nltk.util` module in nltk version 3.9.2 allows arbitrary file read due to improper validation of input paths. The function directly opens files specified by user input without sanitization, enabling attackers to access sensitive system files by providing absolute paths or traversal paths. This vulnerability can be exploited locally or remotely, particularly in scenarios where the function is used in web APIs or other interfaces that accept user-supplied input.

NVD

Vulnerability Analysis

CVE-2026-0846 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. An automatable proof of concept (POC) exploit exists. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
NONE
Availability Impact:
NONE

Weakness Types

Absolute Path Traversal

The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory. This allows attackers to traverse the file system to access files or directories that are outside of the restricted directory.

What is a Directory traversal Vulnerability?

The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

CVE-2026-0846 has been classified to as a Directory traversal vulnerability or weakness.


Products Associated with CVE-2026-0846

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-0846 are published in these products:

Canonical Ubuntu Linux
 
Red Hat Openshift Ai
 
Red Hat Lightspeed Core
 
Red Hat Openshift Lightspeed
 
Red Hat Ansible Automation Platform
 

Affected Versions

nltk/nltk: Red Hat OpenShift AI 2.25: Red Hat OpenShift AI 3.3: Red Hat Lightspeed Core: Red Hat OpenShift Lightspeed: Red Hat Ansible Automation Platform 2: Red Hat OpenShift AI (RHOAI):

Exploit Probability

EPSS
0.36%
Percentile
27.59%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.