SEPTEMBER 19, 2026
Live Feed
Back to database
Case File

CVE-2026-62384

HIGH · CVSS 7.5 EPSS 0.56% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-08-22 · Last synced 2026-09-18

CyberRota Analysis

AI-Generated

Versions of NLTK prior to 3.10.2 are vulnerable to a symlink-based sandbox bypass in the FramenetCorpusReader, allowing attackers to read arbitrary XML files outside the designated corpus root. This vulnerability can be exploited by placing symlinks within the corpus subdirectory, which evade path validation and grant unauthorized access to sensitive files. Organizations using NLTK for natural language processing should prioritize updating to the latest version to mitigate this risk.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-62384
Severity
HIGH
CVSS
7.5
EPSS
0.56%

Original NVD Description

NLTK versions before 3.10.2 contain a symlink-based sandbox bypass in FramenetCorpusReader that allows attackers to read arbitrary XML files outside the corpus root. Attackers can place symlinks with names containing no path separators inside the corpus subdirectory, which pass the path validation guard and are resolved to files outside the intended corpus root when accessed via frame_by_name(), _lu_file(), or doc() methods.

Related CVEs

Other vulnerabilities affecting the same vendor(s)