---
id: CVE-2026-0846
title: >-
  nltk: NLTK: Arbitrary file read via improper path validation in `filestring()`
  function (CVE-2026-0846)
summary: >-
  A flaw was found in the `nltk` component. This vulnerability, specifically
  within the `filestring()` function of the `nltk.util` module, allows an
  attacker to perform arbitrary file reads. By providing specially crafted input
  paths, either…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cvssSource: vendor
cwe:
  - CWE-22
  - CWE-36
vendor: Red Hat
product: OpenShift Lightspeed
affected:
  - lightspeed_core
  - openshift_lightspeed
  - ansible_automation_platform 2
  - openshift_ai_rhoai
  - openshift_ai 2.25
  - openshift_ai 3.3
patched:
  - openshift_ai 2.25
  - openshift_ai 3.3
published: '2026-03-09'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T10:42:42+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0846.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0846.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-0846'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2445826'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-0846'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-0846'
  - url: 'https://huntr.com/bounties/007b84f8-418e-4300-99d0-bf504c2f97eb'
  - url: 'https://access.redhat.com/errata/RHSA-2026:10184'
  - url: 'https://access.redhat.com/errata/RHSA-2026:19712'
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
  - exploit-available
epss: 0.00551
epssPercentile: 0.45908
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-03-12T14:48:03.077006Z'
scores:
  vendor: 7.5
  cna: 8.6
ingestedAt: '2026-09-16T12:55:21.868Z'
---

## Overview

A flaw was found in the `nltk` component. This vulnerability, specifically within the `filestring()` function of the `nltk.util` module, allows an attacker to perform arbitrary file reads. By providing specially crafted input paths, either absolute or using directory traversal, an attacker can bypass input validation and access sensitive system files. This can be exploited both locally and remotely, particularly when the function processes user-supplied input in applications like web APIs.

## Vendor advisories

- **RHSA-2026:10184** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-04-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:10184)
- **RHSA-2026:19712** · Red Hat · fixed in: Red Hat OpenShift AI 3.3 · released 2026-05-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:19712)
- **Red Hat VEX** · Important · affected: Lightspeed Core, OpenShift Lightspeed, Red Hat Ansible Automation Platform 2, Red Hat OpenShift AI (RHOAI) · no fix planned: OpenShift Lightspeed, Red Hat Ansible Automation Platform 2, Red Hat OpenShift AI (RHOAI), Lightspeed Core · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0846.json)

**nltk: NLTK: Arbitrary file read via improper path validation in `filestring()` function** — rated Important by Red Hat. Released 2026-03-09, updated 2026-10-15.

Affected:

- Lightspeed Core
- OpenShift Lightspeed
- Red Hat Ansible Automation Platform 2
- Red Hat OpenShift AI (RHOAI)

Fixed:

- Red Hat OpenShift AI 2.25
- Red Hat OpenShift AI 3.3

No fix planned:

- OpenShift Lightspeed
- Red Hat Ansible Automation Platform 2
- Red Hat OpenShift AI (RHOAI)
- Lightspeed Core

Not affected:

- Red Hat OpenShift AI 2.25
- Red Hat OpenShift AI 3.3
- OpenShift Lightspeed
- Red Hat Ansible Automation Platform 2

## Remediation

For Red Hat OpenShift AI 2.25.5 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ https://access.redhat.com/errata/RHSA-2026:10184
For Red Hat OpenShift AI 3.3.3 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ https://access.redhat.com/errata/RHSA-2026:19712