CVE-2026-71514

NLTK 3.9.4 through 3.10.2 contains a path traversal vulnerability in CrubadanCorpusReader. _load_lang_ngrams joins the corpus root with crubadan_code, the column-0 value read from the corpus table.txt mapping file, and opens the result with the builtin open() rather than the pathsec-validated opener, so os.path.join discards the root when that value is absolute and the read escapes the corpus directory without the containment check nltk.pathsec applies when ENFORCE is set. An attacker who controls a corpus package can disclose file contents outside the corpus root through lang_freq, limited to paths ending in -3grams.txt whose contents parse as token count lines.

• CWE-22

• https://github.com/nltk/nltkProduct
• https://github.com/nltk/nltk/blob/v3.10.2/nltk/corpus/reader/crubadan.py#L90-L98Patch
• https://github.com/nltk/nltk/commit/10d34b3f4fe3fec74b76527a409eb0acbac2e8abPatch
• https://www.vulncheck.com/advisories/nltk-through-path-traversal-via-crubadancorpusreader-pathsec-bypassThird Party Advisory

Published

Aug 22, 2026

Last Modified

Sep 2, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-71508Dolibarr before 24.0.0 contains an improper authorization vu…6.5
• CVE-2026-71509Dolibarr before 24.0.0 contains an improper authorization vu…6.5
• CVE-2026-7151A vulnerability was determined in Tenda HG3 2.0. Impacted is…8.8
• CVE-2026-71510Dolibarr before 24.0.0 contains a SQL injection vulnerabilit…6.5
• CVE-2026-71511Dolibarr before 24.0.0 contains a sensitive data exposure vu…6.5
• CVE-2026-71513NLTK before 3.10.3 contains a remote code execution vulnerab…8.8
• CVE-2026-71518Typemill before 2.26.0 contains an authorization bypass vuln…7.5
• CVE-2026-7152A vulnerability was identified in Totolink A8000RU 7.1cu.643…9.8
• CVE-2026-7153A security flaw has been discovered in Totolink A8000RU 7.1c…9.8
• CVE-2026-71537Paymenter is a free and open-source webshop solution for man…6.5
• CVE-2026-71538@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of …8.5
• CVE-2026-71539n8n is an open source workflow automation platform. Prior to…8.9