CVE-2026-65915

The record

NLTK versions before 3.10.0 contain a logic bug in FileSystemPathPointer.open() where the sandbox validation check compares a normalized path against itself, making the security check permanently inert. Attackers can pass file:// URLs to nltk.data.load() to read arbitrary files accessible to the process user, including credentials and configuration files.

Affected packages

Related vulnerabilities

• CVE-2026-61700 MariaDB Connector/J is used to connect applications developed in Java to MariaDB and… CWE-284
• CVE-2026-65182 Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to… CWE-284
• CVE-2026-70907 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise… CWE-284
• CVE-2026-20716 Improper access control for some Intel(R) Processors within Ring 3: User Applications may… CWE-284
• CVE-2026-72693 `openvt -u` is intended to identify the owner of the current VT and then execute `login`… CWE-284
• CVE-2026-15060 When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows… CWE-284
• CVE-2026-58039 A flaw in Node.js Permission Model enforcement allows process.report writes (and… CWE-284
• CVE-2026-58043 A flaw in Node.js Permission Model enforcement can over-grant filesystem access across… CWE-284