{"id":"CVE-2026-63312","state":"PUBLISHED","title":"NLTK StreamBackedCorpusView Bypasses pathsec.ENFORCE Arbitrary File Read","description":"NLTK before 3.10.0 contains an arbitrary local file read vulnerability in StreamBackedCorpusView that bypasses pathsec.ENFORCE by calling builtins.open() directly instead of pathsec.open(). Attackers who control the fileid argument can read arbitrary local files regardless of the ENFORCE setting, including sensitive system files and application credentials.","publishedAt":"2026-08-22T14:12:40.731Z","updatedAt":"2026-08-24T18:34:55.320Z","severity":{"score":8.7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["nltk nltk"],"affected":[{"vendor":"nltk","product":"nltk","packageURL":"pkg:pypi/nltk","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"3.10.0","versionType":"semver"},{"version":"3.10.0","status":"unaffected","versionType":"semver"}]}],"references":["https://github.com/nltk/nltk/security/advisories/GHSA-x5ph-mj9p-rfr8","https://www.vulncheck.com/advisories/nltk-streambackedcorpusview-bypasses-pathsec-enforce-arbitrary-file-read"],"weaknesses":["CWE-22"],"ingestedAt":"2026-10-29T20:12:41.951Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/63xxx/CVE-2026-63312.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-63312","state":"PUBLISHED","datePublished":"2026-08-22T14:12:40.731Z","dateUpdated":"2026-08-24T18:34:55.320Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-07-16T12:13:18.733Z"},"containers":{"cna":{"title":"NLTK StreamBackedCorpusView Bypasses pathsec.ENFORCE Arbitrary File Read","descriptions":[{"lang":"en","value":"NLTK before 3.10.0 contains an arbitrary local file read vulnerability in StreamBackedCorpusView that bypasses pathsec.ENFORCE by calling builtins.open() directly instead of pathsec.open(). Attackers who control the fileid argument can read arbitrary local files regardless of the ENFORCE setting, including sensitive system files and application credentials."}],"affected":[{"vendor":"nltk","product":"nltk","packageURL":"pkg:pypi/nltk","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"3.10.0","versionType":"semver"},{"version":"3.10.0","status":"unaffected","versionType":"semver"}]}],"references":[{"url":"https://github.com/nltk/nltk/security/advisories/GHSA-x5ph-mj9p-rfr8","tags":["vendor-advisory"],"name":"GitHub Security Advisory (GHSA-x5ph-mj9p-rfr8)"},{"url":"https://www.vulncheck.com/advisories/nltk-streambackedcorpusview-bypasses-pathsec-enforce-arbitrary-file-read","name":"VulnCheck Advisory: NLTK StreamBackedCorpusView Bypasses pathsec.ENFORCE Arbitrary File Read","tags":["third-party-advisory"]}],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH"}},{"format":"CVSS","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-22","lang":"en","description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-08-22T14:12:40.731Z"},"datePublic":"2026-08-07T00:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:nltk:nltk:*:*:*:*:*:*:*:*","versionEndExcluding":"3.10.0"}]}]}],"credits":[{"lang":"en","value":"meme-dm","type":"reporter"}],"x_generator":{"engine":"vulncheck-endgame"}},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://github.com/nltk/nltk/security/advisories/GHSA-x5ph-mj9p-rfr8","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-24T18:34:08.045876Z","id":"CVE-2026-63312","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-24T18:34:55.320Z"}}]}}}