CVE-2026-65915 NLTK before 3.10.0 Arbitrary File Read via FileSystemPathPointer

What is CVE-2026-65915?

CVE-2026-65915 is a high-severity path traversal vulnerability in nltk, published on 22 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

NLTK versions before 3.10.0 contain a logic bug in FileSystemPathPointer.open() where the sandbox validation check compares a normalized path against itself, making the security check permanently inert. Attackers can pass file:// URLs to nltk.data.load() to read arbitrary files accessible to the process user, including credentials and configuration files.

Weakness: CWE-284

Which versions are affected by CVE-2026-65915?

3 open source packages ship an affected version, including nltk. It affects 1 product.

Products include Nltk Nltk.

How do I fix CVE-2026-65915?

Upgrade nltk to 3.10.0 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-65915 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-65915 exists.

Other vulnerabilities in nltk

• CVE-2026-0848 Arbitrary Code Execution in NLTK StanfordSegmenter via Untrusted JAR Loading Critical 10.0
• CVE-2025-14009 Zip Slip Vulnerability in nltk/nltk Leading to Remote Code Execution Critical 10.0
• CVE-2026-78683 NLTK before 3.10.0 Remote Code Execution via Unsafe Pickle Deserialization Critical 9.4
• CVE-2026-79657 NLTK before 3.10.3 Remote Code Execution via Unsafe Pickle Deserialization Critical 9.3
• CVE-2026-79675 NLTK before 3.10.3 JVM Argument Injection via Per-Call Options Critical 9.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-65915, ECHO-c5e2-d7e8-d8ea, GHSA-72r2-7mfr-5xr9, MINI-4x5j-m67q-3rfc, PYSEC-2026-3731, UBUNTU-CVE-2026-65915.