CVE-2026-0846:

Arbitrary file read vulnerability in nltk 3.9.2 due to improper input validation in the filestring() function.

Score
A numerical rating that indicates how dangerous this vulnerability is.

7.5High

Published Date:Mar 9, 2026
CISA KEV Date:*No Data*
Industries Affected:20

Threat Predictions

EPSS Score:0.1
EPSS Percentile:20%

Exploitability

Score:3.9
Attack Vector:NETWORK
Attack Complexity:LOW
Privileges Required:NONE
User Interaction:NONE
Scope:UNCHANGED

Impact

Score:3.6
Confidentiality Impact:HIGH
Integrity Impact:NONE
Availability Impact:NONE

Description Preview

Arbitrary file read vulnerability in nltk 3.9.2 due to improper input validation in the filestring() function.

Overview

The vulnerability (CVE-2026-0846) in nltk 3.9.2 is a critical security flaw that allows unauthorized access to sensitive system files. The filestring() function in the nltk.util module fails to properly validate user-supplied input paths, leading to arbitrary file read capabilities. This vulnerability has a CVSS v3.0 base score of 8.6 (High severity), with a vector string of CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L. The attack vector is network-based, requires low attack complexity, and needs no privileges or user interaction. The primary weakness associated with this vulnerability is CWE-36, which relates to absolute path traversal.

Remediation

To address this vulnerability, developers should implement proper input validation and sanitization in the filestring() function. This includes:
1. Restricting file access to specific directories
2. Implementing a whitelist of allowed file types and locations
3. Sanitizing user input to prevent path traversal attempts
4. Using secure file handling libraries that inherently prevent unauthorized access
Users of nltk 3.9.2 should update to a patched version as soon as it becomes available. In the meantime, it is crucial to limit the use of the filestring() function, especially in contexts where it may process untrusted input.