{"id":"CVE-2026-0846","title":"nltk: NLTK: Arbitrary file read via improper path validation in `filestring()` function (CVE-2026-0846)","summary":"A flaw was found in the `nltk` component. This vulnerability, specifically within the `filestring()` function of the `nltk.util` module, allows an attacker to perform arbitrary file reads. By providing specially crafted input paths, either…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvssSource":"vendor","cwe":["CWE-22","CWE-36"],"vendor":"Red Hat","product":"OpenShift Lightspeed","affected":["lightspeed_core","openshift_lightspeed","ansible_automation_platform 2","openshift_ai_rhoai","openshift_ai 2.25","openshift_ai 3.3"],"patched":["openshift_ai 2.25","openshift_ai 3.3"],"published":"2026-03-09","updated":"2026-10-15","sourceUpdated":"2026-10-15T10:42:42+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0846.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0846.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-0846"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445826"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-0846"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0846"},{"url":"https://huntr.com/bounties/007b84f8-418e-4300-99d0-bf504c2f97eb"},{"url":"https://access.redhat.com/errata/RHSA-2026:10184"},{"url":"https://access.redhat.com/errata/RHSA-2026:19712"}],"tags":["csaf","vex","red-hat","cve.org","exploit-available"],"epss":0.00551,"epssPercentile":0.45908,"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-03-12T14:48:03.077006Z"},"scores":{"vendor":7.5,"cna":8.6},"ingestedAt":"2026-09-16T12:55:21.868Z","slug":"CVE-2026-0846","body":"## Overview\n\nA flaw was found in the `nltk` component. This vulnerability, specifically within the `filestring()` function of the `nltk.util` module, allows an attacker to perform arbitrary file reads. By providing specially crafted input paths, either absolute or using directory traversal, an attacker can bypass input validation and access sensitive system files. This can be exploited both locally and remotely, particularly when the function processes user-supplied input in applications like web APIs.\n\n## Vendor advisories\n\n- **RHSA-2026:10184** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-04-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:10184)\n- **RHSA-2026:19712** · Red Hat · fixed in: Red Hat OpenShift AI 3.3 · released 2026-05-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:19712)\n- **Red Hat VEX** · Important · affected: Lightspeed Core, OpenShift Lightspeed, Red Hat Ansible Automation Platform 2, Red Hat OpenShift AI (RHOAI) · no fix planned: OpenShift Lightspeed, Red Hat Ansible Automation Platform 2, Red Hat OpenShift AI (RHOAI), Lightspeed Core · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0846.json)\n\n**nltk: NLTK: Arbitrary file read via improper path validation in `filestring()` function** — rated Important by Red Hat. Released 2026-03-09, updated 2026-10-15.\n\nAffected:\n\n- Lightspeed Core\n- OpenShift Lightspeed\n- Red Hat Ansible Automation Platform 2\n- Red Hat OpenShift AI (RHOAI)\n\nFixed:\n\n- Red Hat OpenShift AI 2.25\n- Red Hat OpenShift AI 3.3\n\nNo fix planned:\n\n- OpenShift Lightspeed\n- Red Hat Ansible Automation Platform 2\n- Red Hat OpenShift AI (RHOAI)\n- Lightspeed Core\n\nNot affected:\n\n- Red Hat OpenShift AI 2.25\n- Red Hat OpenShift AI 3.3\n- OpenShift Lightspeed\n- Red Hat Ansible Automation Platform 2\n\n## Remediation\n\nFor Red Hat OpenShift AI 2.25.5 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_ai/ https://access.redhat.com/errata/RHSA-2026:10184\nFor Red Hat OpenShift AI 3.3.3 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_ai/ https://access.redhat.com/errata/RHSA-2026:19712","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":218770,"id":"CVE-2026-0846","ts":1791620502982,"field":"cvss","old":"8.6","new":"7.5"}]}