{"id":"CVE-2026-0847","title":"nltk: NLTK: Arbitrary file read via path traversal vulnerability (CVE-2026-0847)","summary":"A flaw was found in NLTK (Natural Language Toolkit). This vulnerability allows a remote attacker to read arbitrary files on the server due to improper sanitization of file paths in several CorpusReader classes, including WordListCorpusRead…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvssSource":"vendor","cwe":"CWE-22","vendor":"Red Hat","product":"OpenShift Lightspeed","affected":["lightspeed_core","openshift_lightspeed","ansible_automation_platform 2","openshift_ai_rhoai","openshift_ai 2.25","openshift_ai 3.3"],"patched":["openshift_ai 2.25","openshift_ai 3.3"],"published":"2026-03-04","updated":"2026-10-15","sourceUpdated":"2026-10-15T10:42:50+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0847.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0847.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-0847"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2444608"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-0847"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0847"},{"url":"https://huntr.com/bounties/fc69914f-36a9-4c18-8503-10013b39f966"},{"url":"https://access.redhat.com/errata/RHSA-2026:10184"},{"url":"https://access.redhat.com/errata/RHSA-2026:19712"}],"tags":["csaf","vex","red-hat","exploit-available","cve.org"],"epss":0.00935,"epssPercentile":0.60603,"exploits":{"github":1,"githubRepos":["https://github.com/HyperPS/CVE-2026-0847"],"checkedAt":"2026-10-27T16:52:00.256Z"},"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-03-04T18:49:39.659563Z"},"scores":{"vendor":7.5,"cna":8.6},"ingestedAt":"2026-09-16T12:55:21.868Z","slug":"CVE-2026-0847","body":"## Overview\n\nA flaw was found in NLTK (Natural Language Toolkit). This vulnerability allows a remote attacker to read arbitrary files on the server due to improper sanitization of file paths in several CorpusReader classes, including WordListCorpusReader, TaggedCorpusReader, and BracketParseCorpusReader. By exploiting this path traversal vulnerability, an attacker can gain unauthorized access to sensitive information, such as system files, SSH private keys, and API tokens. In certain scenarios, this could potentially lead to remote code execution.\n\n## Vendor advisories\n\n- **RHSA-2026:10184** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-04-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:10184)\n- **RHSA-2026:19712** · Red Hat · fixed in: Red Hat OpenShift AI 3.3 · released 2026-05-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:19712)\n- **Red Hat VEX** · Important · affected: Lightspeed Core, OpenShift Lightspeed, Red Hat Ansible Automation Platform 2, Red Hat OpenShift AI (RHOAI) · no fix planned: OpenShift Lightspeed, Red Hat Ansible Automation Platform 2, Red Hat OpenShift AI (RHOAI), Lightspeed Core · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0847.json)\n\n**nltk: NLTK: Arbitrary file read via path traversal vulnerability** — rated Important by Red Hat. Released 2026-03-04, updated 2026-10-15.\n\nAffected:\n\n- Lightspeed Core\n- OpenShift Lightspeed\n- Red Hat Ansible Automation Platform 2\n- Red Hat OpenShift AI (RHOAI)\n\nFixed:\n\n- Red Hat OpenShift AI 2.25\n- Red Hat OpenShift AI 3.3\n\nNo fix planned:\n\n- OpenShift Lightspeed\n- Red Hat Ansible Automation Platform 2\n- Red Hat OpenShift AI (RHOAI)\n- Lightspeed Core\n\nNot affected:\n\n- Red Hat OpenShift AI 2.25\n- Red Hat OpenShift AI 3.3\n- OpenShift Lightspeed\n- Red Hat Ansible Automation Platform 2\n\n## Remediation\n\nFor Red Hat OpenShift AI 2.25.5 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_ai/ https://access.redhat.com/errata/RHSA-2026:10184\nFor Red Hat OpenShift AI 3.3.3 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_ai/ https://access.redhat.com/errata/RHSA-2026:19712","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":41.3,"likelihood":0.2,"exploitation":12,"ransomware":0},"changes":[{"seq":218769,"id":"CVE-2026-0847","ts":1791620501691,"field":"cvss","old":"8.6","new":"7.5"}]}