CyberRota Analysis
AI-GeneratedNLTK versions prior to 3.10.0 are susceptible to a path traversal vulnerability in the FramenetCorpusReader and NKJPCorpusReader, enabling attackers to read arbitrary XML files outside the designated corpus root by manipulating unsafe selectors or poisoned index states. This vulnerability can be exploited through specific methods such as frame_by_name, doc, lu, and header, potentially leading to unauthorized data exposure. Organizations using affected NLTK versions should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
NLTK versions before 3.10.0 contain a path traversal vulnerability in FramenetCorpusReader and NKJPCorpusReader that allows attackers to parse XML files outside the corpus root by supplying unsafe selectors or poisoned index state. Attackers can exploit frame_by_name, doc, lu, and header methods with crafted parameters to read arbitrary XML files accessible to the application.
Related CVEs
Other vulnerabilities affecting the same vendor(s)