# CVE-2026-65915: NLTK FileSystemPathPointer sandbox bypass arbitrary file read

Source: https://junglewise.ai/threats/cve-2026-65915-nltk-filesystempathpointer-sandbox-bypass-arbitrary-file-read  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-22. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-65915 · Severity: medium · CVSS 6.5 · Published 2026-08-22

NLTK is a Python library commonly used in natural language processing applications and data science workflows. A flaw in its file loading function allows attackers to read any file on the system that the application process can access (such as /etc/passwd, environment files with credentials, or private keys) by passing specially crafted file:// URLs. This is particularly dangerous in web applications, notebook servers, or multi-tenant environments where user input influences file paths.

Technologies: [nltk (PyPI)](https://junglewise.ai/threats/technologies/nltk). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-65915 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-65915 being exploited in the wild.

**How severe is CVE-2026-65915?** Medium severity, with a CVSS score of 6.5, published 22 August 2026.

**Which products and versions are affected?** nltk (PyPI) <= 3.9.3, ECOSYSTEM:introduced=0,fixed=3.10.0.

**Is there a fix for CVE-2026-65915?** Yes. nltk (PyPI): upgrade to 3.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-65915 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-65915?** Check whether you run nltk (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- nltk (PyPI): upgrade to 3.10.0 or later

  ```sh
  pip install "nltk>=3.10.0"
  ```


## Technical details

The vulnerability is a dead-code logic error in FileSystemPathPointer.open() within nltk/data.py (lines 378–390). The check intended to block absolute file access compares os.path.normpath(self._path) against itself—they are always equal, so the ValueError guard never executes. Additionally, __init__ already calls os.path.abspath(), so re-running normpath in open() has no effect. Consequently, the stream = open(self._path, "rb") line is always reached regardless of the path provided. An attacker can exploit this by passing file:// URLs to nltk.data.load() or calling FileSystemPathPointer directly with any path the process user can read. The vulnerability requires low privileges (no special user rights) and is accessible over the network if the vulnerable code is exposed via a web API. Patched in NLTK 3.10.0; affected versions are ≤ 3.9.3.

## Affected products

- NLTK NLTK <= 3.9.3

## Identifiers

- CVE-2026-65915
- GHSA-72r2-7mfr-5xr9
- PYSEC-2026-3731

## Timeline

- 2026-09-08: disclosed: Published to GitHub Advisory Database
- 2026-08-07: advisory: GitHub security advisory published
- 2026-09-01: patched: Patched in NLTK 3.10.0

## References

- [https://api.github.com/users/ZeroXJacks](https://api.github.com/users/ZeroXJacks)
- [https://github.com/ZeroXJacks](https://github.com/ZeroXJacks)
- [https://api.github.com/users/ZeroXJacks/gists%7B/gist_id%7D](https://api.github.com/users/ZeroXJacks/gists%7B/gist_id%7D)
- [https://api.github.com/users/ZeroXJacks/repos](https://api.github.com/users/ZeroXJacks/repos)
- [https://avatars.githubusercontent.com/u/189536965?v=4](https://avatars.githubusercontent.com/u/189536965?v=4)
- [https://api.github.com/users/ZeroXJacks/events%7B/privacy%7D](https://api.github.com/users/ZeroXJacks/events%7B/privacy%7D)

## Related threats

- [NLTK WekaClassifier path traversal in model validation](https://junglewise.ai/threats/cve-2026-109956-nltk-through-3-10-3-contains-a-path-traversal-vulnerability-in)
- [NLTK RecursiveDescentParser uncontrolled recursion denial of service](https://junglewise.ai/threats/cve-2026-12876-nltk-recursivedescentparser-uncontrolled-recursion-denial-of)
- [NLTK tgrep regular expression denial of service](https://junglewise.ai/threats/nltk-tgrep-regular-expression-denial-of-service-02fca1b2)
- [NLTK Downloader hardlink filesystem containment bypass](https://junglewise.ai/threats/nltk-downloader-hardlink-filesystem-containment-bypass-522cb97d)
- [NLTK Pl196xCorpusReader quadratic ReDoS on malformed TEI blocks](https://junglewise.ai/threats/nltk-pl196xcorpusreader-quadratic-redos-on-malformed-tei-blocks-8473e6ef)