Path traversal in Natural Language Toolkit - CVE-2026-54294
Published: August 7, 2026
Vulnerability identifier: #VU141245
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-54294
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to path traversal in NKJPCorpusReader when processing attacker-influenced fileids in public read methods. A remote attacker can supply crafted fileids containing directory traversal sequences to disclose sensitive information.
The issue bypasses the nltk.pathsec sandbox even when ENFORCE is set to true, and the header() method returns content from out-of-root files to the caller.
Affected software
Natural Language Toolkit
How to mitigate CVE-2026-54294
Install security update from vendor's website.
Natural Language Toolkit - update to 3.10.0