CVE-2026-62383 nltk IPIPANCorpusReader Symlink Arbitrary File Read
Attackers can read arbitrary files by placing symlinks in the corpus directory, bypassing security checks in the nltk library.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-62383?
CVE-2026-62383 is a medium-severity path traversal vulnerability in nltk, published on 22 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
nltk versions before 3.10.2 contain a symlink-based arbitrary file read vulnerability in IPIPANCorpusReader methods that bypass nltk.pathsec validation entirely. Attackers can place a symlink in the corpus root directory and read arbitrary files accessible to the process by calling channels(), domains(), categories(), or fileids() methods with the symlink filename.
Weakness: CWE-22
Which versions are affected by CVE-2026-62383?
3 open source packages ship an affected version, including nltk. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
nltk PyPI | From 3.10.0 | 3.10.2 |
nltk PyPI | From 3.10.0 | 3.10.2 |
nltk PyPI | From 3.10.0 | 3.10.2 |
Products include Nltk Nltk.
How do I fix CVE-2026-62383?
Upgrade nltk to 3.10.2 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-62383 being exploited?
There is no known exploitation of CVE-2026-62383 in the wild and no public exploit code.
Other vulnerabilities in nltk
- CVE-2026-0848 Arbitrary Code Execution in NLTK StanfordSegmenter via Untrusted JAR Loading
- CVE-2025-14009 Zip Slip Vulnerability in nltk/nltk Leading to Remote Code Execution
- CVE-2026-78683 NLTK before 3.10.0 Remote Code Execution via Unsafe Pickle Deserialization
- CVE-2026-79657 NLTK before 3.10.3 Remote Code Execution via Unsafe Pickle Deserialization
- CVE-2026-79675 NLTK before 3.10.3 JVM Argument Injection via Per-Call Options
Sources
Also known as DEBIAN-CVE-2026-62383, GHSA-3hhw-38pf-pxj6, PYSEC-2026-3726, UBUNTU-CVE-2026-62383.