Improper access control in Natural Language Toolkit - #VU141253
Published: August 7, 2026
Vulnerability identifier: #VU141253
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper access control in FileSystemPathPointer.open() in nltk/data.py when handling file:// URLs through nltk.data.load() or user-influenced paths. A remote user can supply a crafted file:// URL or path to read arbitrary files accessible to the process and disclose sensitive information.
Applications are exposed when users can influence the string passed to nltk.data.load() or nltk.data.find().
Affected software
Natural Language Toolkit
Remediation
Install security update from vendor's website.
Natural Language Toolkit - update to 3.10.0