Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-08-25T15:16:00 nltk: NLTK: Information disclosure via path traversal in corpus-reader constructors 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CWE-22

NLTK versions before 3.10.3 contain a path sandbox bypass vulnerability in corpus-reader constructors that allows attackers to read files outside the intended data root. Attackers can supply arbitrary corpus root paths to LinThesaurusCorpusReader and PanLexLiteCorpusReader constructors to access filesystem content and SQLite databases outside the pathsec sandbox boundary.

A flaw was found in NLTK. A path traversal vulnerability in corpus-reader constructors allows a remote attacker to bypass the intended data root sandbox. By supplying arbitrary corpus root paths to LinThesaurusCorpusReader and PanLexLiteCorpusReader constructors, an attacker can read files and access SQLite databases outside the security boundary, leading to information disclosure.

A path traversal vulnerability exists in NLTK's corpus reader constructors LinThesaurusCorpusReader and PanLexLiteCorpusReader. The constructors fail to validate user-supplied corpus root paths against the pathsec sandbox boundary before accessing underlying filesystem directories and SQLite databases. An attacker capable of supplying arbitrary corpus root inputs can read files outside the intended data directory. Data exposure is restricted to files readable by the executing process user, and OS discretionary access controls or container isolation boundaries prevent privilege escalation beyond the application context. Sanitize user input passed to `LinThesaurusCorpusReader` and `PanLexLiteCorpusReader` initialization arguments to enforce strict path validation against expected data root directories before loading corpus files or SQLite databases. Exploit Intelligence Will not fix exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 Lightspeed Core Affected lightspeed-core/lightspeed-stack-rhel9 Lightspeed Core Affected lightspeed-core/rag-tool-cpu-rhel9 Lightspeed Core Affected lightspeed-core/rag-tool-cuda-12.9-rhel9 OpenShift Lightspeed Not affected openshift-lightspeed/lightspeed-ocp-rag-rhel9 OpenShift Lightspeed Affected openshift-lightspeed/lightspeed-service-api-rhel9 OpenShift Lightspeed Not affected openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9 Red Hat Ansible Automation Platform 2 Will not fix ansible-automation-platform-25/lightspeed-chatbot-rhel8 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-llama-stack-core-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-ogx-core-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-ta-lmes-job-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-trustyai-nemo-guardrails-server-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-79674 https://nvd.nist.gov/vuln/detail/CVE-2026-79674 https://github.com/nltk/nltk/security/advisories/GHSA-3gq4-3j92-5w49 https://www.vulncheck.com/advisories/nltk-path-traversal-via-corpus-reader-constructors