Link following in Natural Language Toolkit - CVE-2026-70626
Published: August 7, 2026 / Updated: September 14, 2026
Vulnerability identifier: #VU141255
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-70626
CWE-ID: CWE-59
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to improper link resolution before file access in nltk.corpus.reader.api.CorpusReader.open() and FileSystemPathPointer.join() when opening corpus files through a symlink placed under the corpus root. A local user can place or influence a symlinked path inside the allowed corpus root to disclose sensitive information.
The issue bypasses the intended filesystem boundary because the path check is performed on the lexical path rather than the resolved path after following symlinks.
Affected software
Natural Language Toolkit
How to mitigate CVE-2026-70626
Install security update from vendor's website.
Natural Language Toolkit - update to 3.9.4