CVE-2026-65915: NLTK FileSystemPathPointer sandbox bypass arbitrary file read

CVE-2026-65915 · Severity: medium · CVSS 6.5 · Published 2026-08-22

NLTK is a Python library commonly used in natural language processing applications and data science workflows. A flaw in its file loading function allows attackers to read any file on the system that the application process can access (such as /etc/passwd, environment files with credentials, or private keys) by passing specially crafted file:// URLs. This is particularly dangerous in web applications, notebook servers, or multi-tenant environments where user input influences file paths.

Technologies: nltk (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-65915 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-65915 being exploited in the wild.
How severe is CVE-2026-65915?
Medium severity, with a CVSS score of 6.5, published 22 August 2026.
Which products and versions are affected?
nltk (PyPI) <= 3.9.3, ECOSYSTEM:introduced=0,fixed=3.10.0.
Is there a fix for CVE-2026-65915?
Yes. nltk (PyPI): upgrade to 3.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-65915 attacked?
It is attacked over the network.
Am I affected by CVE-2026-65915?
Check whether you run nltk (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • nltk (PyPI): upgrade to 3.10.0 or later
    pip install "nltk>=3.10.0"

Technical details

The vulnerability is a dead-code logic error in FileSystemPathPointer.open() within nltk/data.py (lines 378–390). The check intended to block absolute file access compares os.path.normpath(self._path) against itself—they are always equal, so the ValueError guard never executes. Additionally, __init__ already calls os.path.abspath(), so re-running normpath in open() has no effect. Consequently, the stream = open(self._path, "rb") line is always reached regardless of the path provided. An attacker can exploit this by passing file:// URLs to nltk.data.load() or calling FileSystemPathPointer directly with any path the process user can read. The vulnerability requires low privileges (no special user rights) and is accessible over the network if the vulnerable code is exposed via a web API. Patched in NLTK 3.10.0; affected versions are ≤ 3.9.3.

Affected products

  • NLTK NLTK <= 3.9.3

Identifiers

  • CVE-2026-65915
  • GHSA-72r2-7mfr-5xr9
  • PYSEC-2026-3731

Timeline

  • 2026-09-08: disclosed: Published to GitHub Advisory Database
  • 2026-08-07: advisory: GitHub security advisory published
  • 2026-09-01: patched: Patched in NLTK 3.10.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.