CVE-2026-70626
Last modified
CVE-2026-70626 is a medium-severity vulnerability rated 6.2/10 on the CVSS scale. NLTK versions before 3.9.4 contain a symlink escape vulnerability in CorpusReader.open() that allows local attackers to read arbitrary files outside the corpus root. The vulnerability exists because path validation is lexical and does not account for symlink resolution, enabling attackers to place symlinks inside the corpus root to access files outside the intended boundary.. EPSS estimates a 0.14% chance of exploitation in the next 30 days.
Description
NLTK versions before 3.9.4 contain a symlink escape vulnerability in CorpusReader.open() that allows local attackers to read arbitrary files outside the corpus root. The vulnerability exists because path validation is lexical and does not account for symlink resolution, enabling attackers to place symlinks inside the corpus root to access files outside the intended boundary.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Nltk | Nltk | < 3.9.4 |
References
- https://github.com/nltk/nltk/security/advisories/GHSA-r6gq-whwq-mvg9Exploit, Vendor Advisory
- https://github.com/nltk/nltk/security/advisories/GHSA-r6gq-whwq-mvg9Exploit, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-70626?
How severe is CVE-2026-70626?
How do I fix CVE-2026-70626?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-70619Odysseus before commit bf325f6 contains a missing authorizat…8.8
- CVE-2026-7062A security vulnerability has been detected in Intina47 conte…7.3
- CVE-2026-70620Odysseus before commit 87babb5 contains a server-side reques…6.8
- CVE-2026-70622tar-rs versions 0.4.11 through 0.4.46 contain a symlink esca…6.5
- CVE-2026-70623Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2026-70624Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2026-70628FFmpeg versions from 0.5 up to, but not including, 9.0 conta…7.8
- CVE-2026-70629FFmpeg versions from 3.0 up to, but not including, 9.0 conta…5.5
- CVE-2026-7063A vulnerability was detected in code-projects Employee Manag…7.3
- CVE-2026-70630FFmpeg versions from 3.0 up to, but not including, 9.0 conta…5.5
- CVE-2026-70631FFmpeg versions from 0.5 up to, but not including, 9.0 conta…5.5
- CVE-2026-70632FFmpeg versions from 4.4 up to, but not including, 9.0 conta…7.8
Are you affected by CVE-2026-70626?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST